JP2023529783A - Improved performance of secure multiparty computation - Google Patents

Abstract

This specification relates to using secure MPC to select digital components in a manner that preserves user privacy and protects the security of data for each party involved in the selection process. In one aspect, a method includes receiving a digital component request and a nonce from a client device by a first computing system of a secure MPC system. The first computing system generates, based on the nonce and the function, an array that includes shares of Bloom filters representing user group identifiers of user groups that include the user of the client device as a member. For each of the plurality of user group identifiers, the first computing system cooperates with one or more second computing systems of the secure MPC system to identify one or more user group memberships using an array. Compute the first secret share of each of the condition parameters.

Description

This specification relates to cryptography and data security.

Secure multi-party computations (MPCs) are computations performed across multiple parties so that output is emitted only to designated parties, while no individual party has access to another party's data or intermediate computations. A family of cryptographic protocols that block access to data by distributing computation. MPC computing systems typically perform computations using secret shares or other encrypted forms of data and secure exchange of information between parties.

In general, one inventive aspect of the subject matter described herein is the steps of receiving a digital component request and a nonce from a client device by a first computing system of a secure multi-party computing (MPC) system; generating an array containing a share of bloom filters representing user group identifiers of user groups that include users of client devices as members, based on a function; One or more user group membership condition parameters in cooperation with the second computing system and using the array to represent whether the user of the client device is a member of the user group identified by the user group identifier. and for each digital component of the plurality of digital components, identifying a given user group identifier corresponding to the digital component, and by the first computing system, a or in cooperation with each of a plurality of second computing systems, at least a respective first secret of each user group membership condition parameter corresponding to a given user group identified by a given user group identifier; and a second secret share of user group membership condition parameters corresponding to a given user group identified by a given user group identifier maintained by each of the one or more second computers. calculating a first secret share of a candidate parameter, the candidate parameter indicating whether the digital component is an eligible candidate for a digital component request; generating a first secret share of the selection result representing the selected digital component based on the first secret share of the candidate parameter of the component and the selected value of each digital component; to the client device. Other implementations of this aspect include corresponding apparatus, systems, and computer programs configured to carry out aspects of the method encoded in computer storage devices.

These and other implementations can each optionally include one or more of the following features. In some aspects, the step of calculating, in cooperation with one or more second computers of a second MPC system, the first secret share of the user group membership condition parameters comprises a garbled circuit protocol or Calculating a first secret share of user group membership condition parameters using one of the Goldreich-Micali-Wigderson (GMW) protocols.

In some aspects, the step of calculating, in cooperation with each of the one or more second computers, the first secret share of the candidate parameters is the step of computing each of the parameters for the one or more additional conditions. calculating a first secret share of the candidate parameter based on the secret shares of .

Some aspects include the steps of: receiving additional nonces of additional Bloom filters representing sets of block digital components; generating additional arrays representing shares of the additional Bloom filters; a block condition parameter representing whether or not the digital component is blocked on the client device, using an additional array, in cooperation with one or more second computing systems, for one or more digital components of and calculating a first secret share of . Candidate parameters for digital components are based on block condition parameters.

In some aspects, the first secret share of the selection result includes a result calculated by performing a bitwise XOR operation between the secret share of the selection result and the second mask received from the client device. . In some aspects, a first computing system includes a serving pool that includes a set of processors and a load balancer that balances computing load among the set of processors. A first computing system generates snapshots based on updates to the log containing data related to the completed digital component selection process, and a log processor pool that includes an additional set of processors that provide the snapshots to the serving pool. can include

The subject matter described herein may be implemented in particular embodiments to achieve one or more of the following advantages. Using a secure MPC process, run by two or more MPC servers operated by different parties, to select digital components based on sharing of user information, provided there is no unauthorized collusion between the MPC servers. user information cannot be accessed in cleartext by either the MPC server or another party. As such, user data privacy is preserved as long as at least one MPC server is fair.

In the digital component selection process, the MPC server can select from eligible digital components that meet one or more eligibility conditions while preventing that party from accessing user information in plaintext. Eligibility conditions can include, among other factors, constraints and guidelines on the manner or frequency of distribution of the digital component. Conditions can include user group membership, frequency control, muting (eg, user blocking), k-anonymity to prevent micro-targeting of users, and/or pacing and budget constraints.

Since digital component selection is an online process that typically occurs at the time the content is loaded on the client device, it is important that this process be completed quickly, eg, within milliseconds. The techniques described herein reduce the size of data transmitted between client devices and the MPC cluster, by reducing the computational resources required by the MPC cluster, and by reducing the size of the MPC cluster. It enhances the speed at which digital components are selected by reducing the number of round-trip communications/computations performed by the servers and the size of the data transmitted between servers. Reducing the data size between the client device and the server also reduces network bandwidth consumption and battery consumption of the client device, for example when the client device is a mobile device that operates on battery power.

A user's client device can generate a probabilistic data structure, e.g., a Cuckoo filter or a Bloom filter, representing a user group that includes the user as a member, and generates a probabilistic data structure, or data representing the probabilistic data structure. It can be provided to the servers of the MPC cluster. Using probabilistic data structures in this way protects user privacy and maintains data security by preventing access to user group memberships, and probabilistic data structures provide a compact representation of a set of data. thus reducing the size of the information provided to the MPC cluster. The data representing the probabilistic data structure is such that a party receiving only part of the data can either have the other part, or the user's It can be generated and sent to the MPC server so that user group membership cannot be accessed. Reducing the data size reduces the amount of bandwidth consumed to transmit information, reduces latency in transmitting information, and the device running on battery required to transmit information. Reduce the amount of processing power and associated battery power for (e.g., mobile devices).

The MPC cluster can transmit a secret share of the results identifying the selected digital components that the MPC cluster has selected using the secure MPC process. Sending secret shares of results to only selected digital components, rather than information for all or a large set of digital components, reduces latency and consumes bandwidth, processing power, and overhead in sending and receiving results. Battery power is similarly reduced. This also exposes the potential disclosure of sensitive information of content platforms that submit selection values for digital components to the MPC cluster by limiting the number of digital components for which information is provided to client devices. to reduce

Reducing latency in content presentation also reduces the number of errors that occur at user devices while waiting for such content to arrive. Since content often must be delivered in milliseconds to mobile devices connected by wireless networks, reducing latency in selecting and delivering content helps prevent errors and reduce user frustration. important to

The secure MPC techniques described herein are flexible and support different types of selection processes and/or additional selection process features such as floors, hierarchies, and/or boosts. The secure MPC techniques described herein enable such functionality while still preserving user privacy and data security. When a hierarchy is used, multiple selection processes can be performed in parallel to reduce latency in selecting digital components, or can be performed sequentially to reduce unnecessary computations. Metrics that can be used to improve the efficiency of the digital component selection process can be aggregated and reported to appropriate parties so as to preserve user privacy.

The details of one or more embodiments of the subject matter described in this specification are set forth in the accompanying drawings and the description below. Other features, aspects, and advantages of the subject matter will be apparent from the description, drawings, and claims.

1 is a block diagram of an environment in which an MPC cluster executes a secure MPC process to select digital components for delivery to client devices; FIG. 2 illustrates an exemplary data flow within the environment of FIG. 1; FIG. FIG. 4 is an illustration of an exemplary process for selecting digital components for delivery to client devices; FIG. 4 is an illustration of an exemplary process for selecting digital components for delivery to client devices; FIG. 4 is an illustration of an exemplary process for selecting digital components for delivery to client devices; FIG. 4 is an exemplary process for determining best alternative selection values for digital components within a digital component selection process; FIG. 5 is a flow diagram of an exemplary process for determining a difference between first selection values of an actual digital component selection process and a counterfactual digital component selection process; FIG. FIG. 10 is a flow diagram of an exemplary process for determining whether a user is a member of a user group using a bloom filter sent using a secret share; FIG. 1 is a block diagram of an exemplary MPC computer system; FIG. 1 is a block diagram of an exemplary computer system; FIG.

The same reference numbers and designations in the various drawings indicate similar elements.

In general, this specification describes systems and techniques for selecting digital components using secure MPC to preserve user privacy and protect the data security of each party involved in the selection process. . The selection process enhancements support multiple changes to the digital component selection process, giving content publishers and content platforms the flexibility to manage digital component selection while maintaining user privacy and data security. For example, the MPC clusters described herein may include hierarchies, selection value boosting, first value selection processes, second value selection processes, and/or combinations of one or more of these variations. A secure digital component selection process can be implemented that includes: The techniques described herein minimize the size of the data sent to and from the client device that displays the digital component, while minimizing the size of the data sent, for example, a few milliseconds after the request is received. It allows for such flexibility, privacy preservation, and data security while still providing digital components within short time periods such as within.

The MPC cluster can also generate information, eg, metrics, based on the completed selection process that can be used to further enhance the further digital component selection process. This information uses secure MPC so that user data and publisher and/or content platform data cannot be accessed without unauthorized collusion between the servers of the MPC cluster and/or other parties. can be generated by Information can be reported to the appropriate party in encrypted form, eg, secret shares, so that only the recipient can access the information in plaintext. To protect user privacy, in some implementations, the intended recipient may have access to the information in plaintext, in which differential privacy noise has been added and/or in the form desired to be aggregated. Plaintext is text that is not computationally tagged, specially formatted, or written in code, or that can be viewed without the need for a key or other decryption device or other decryption process. Or data in a form that can be used, including binary files.

Some computations performed on secret shares by the MPC cluster are shown herein as being products or sums of secret share values. To increase the speed at which these calculations are performed, multiplication can be performed on the secret share using an AND operation, such as a bitwise AND, and an XOR operation, such as a bitwise XOR operation, can be used to perform the secret share Addition can be performed in In some cases, when one plaintext integer is multiplied by a secret share representing 0 or 1 in Z2 (i.e., the sum of the two shares modulo 2 is 0 or 1), the multiplication or bit-AND is unnecessary. Alternatively, each computing system can evaluate its share and return its integer if its share is 1 and 0 if its share is 0.

FIG. 1 is a block diagram of an environment 100 in which an MPC cluster 130 performs a secure MPC process to select digital components for delivery to client devices 110. As shown in FIG. The MPC cluster 130 also generates information of the completed digital component selection process and provides this information to the appropriate parties.

Exemplary environment 100 includes a data communication network 105 such as a local area network (LAN), wide area network (WAN), the Internet, mobile networks, or combinations thereof. The network 105 includes client devices 110, secure MPC clusters 130, publishers 140, websites 142, and content platforms such as supply-side platforms (SSPs) 170 and demand-side platforms (DSPs). Connect 150. Exemplary environment 100 can include many different client devices 110 , secure MPC clusters 130 , publishers 140 , websites 142 , DSPs 150 and SSPs 170 .

Website 142 includes one or more electronic resources 145 . A resource 145 may be associated with a domain name and hosted by one or more servers. An exemplary website is a collection of web pages formatted in Hypertext Markup Language (HTML) that can include programming elements such as text, images, multimedia content, and scripts. Each website 142 is maintained by a content publisher 140 , an entity that controls, manages and/or owns website 142 .

Resource 145 is any data that can be provided over network 105 by publisher 140 and that can be associated with a resource address. Resources include HTML pages, word processing documents, and Portable Document Format (PDF) documents, images, videos, and feed sources, just to name a few. Resources 145 can include content such as words, phrases, pictures, etc., and may include embedded information (eg, metadata information and hyperlinks) and/or embedded instructions such as, for example, scripts.

Client device 110 is an electronic device capable of communicating over network 105 . Exemplary client devices 110 include personal computers, mobile communication devices such as smart phones, and other devices capable of sending and receiving data over network 105 . Client device 110 may also include a digital assistant device that accepts audio input through a microphone and outputs audio output through speakers. When the digital assistant detects a "hot word" or "hot phrase" that activates the microphone to accept audio input, the digital assistant enters listening mode (e.g., ready to accept audio input). can be done. Digital assistant devices can also include cameras and/or displays for capturing images and visually presenting information. Digital assistants may be implemented in different forms of hardware devices, including wearable devices (eg, watches or glasses), smartphones, speaker devices, tablet devices, or other hardware devices. Client devices 110 may also include digital media devices, such as streaming devices that plug into a television or other display to stream video to the television, gaming systems, or virtual reality systems.

Client device 110 typically includes an application 112 such as a web browser and/or native application to facilitate sending and receiving data over network 105 . A native application is an application developed for a specific platform or a specific device, for example a mobile device with a specific operating system. A publisher 140 can develop native applications and provide them to client devices 110, eg, make them available for download. The web browser, for example, responds to a user of client device 110 entering a resource address for resource 145 into the web browser's address bar or selecting a link that references the resource address. Resources 145 can be requested from a web server that hosts website 142 . Similarly, native applications can request application content from the publisher's remote server.

Some resources, application pages, or other application content may include digital component slots for displaying digital components with the resource 145 or application page. As used throughout this specification, the phrase "digital component" refers to any discrete unit of digital content or digital information (e.g., video clip, audio clip, multimedia clip, image, text, or another unit of content). point to A digital component may be stored electronically in a physical memory device as a single file or as a collection of files; the digital component may be a video file, audio file, multimedia file, image file, or text file. It may take a form and contain advertising information, and thus an advertisement is a type of digital component. For example, a digital component may be a web page displayed by application 112, application content (eg, an application page), or content intended to supplement the content of other resources. More specifically, the digital component may include digital content related to the resource content, eg, the digital component may relate to the same topic as, or a related topic to, the web page content. Therefore, the provisioning of digital components can complement and generally enhance web page or application content.

When application 112 loads a resource (or application content) that includes one or more digital component slots, application 112 can request a digital component for each slot. In some implementations, a digital component slot contains code, e.g., one or more scripts, that, when processed by application 112, causes application 112 to request a digital component for display to a user of client device 110. obtain. As described below, application 112 may request digital components from MPC cluster 130 and/or one or more SSPs 170 .

Some publishers 140 use SSPs 170 to manage the process of obtaining digital components for their resources 145 and/or application 112 digital component slots. SSP 170 is a technology platform implemented in hardware and/or software that automates the process of obtaining digital components for resources and/or applications. Each publisher 140 may have a corresponding SSP 170 or multiple SSPs 170 . Several publishers 140 may use the same SSP 170.

Digital component providers 160 can create (or otherwise publish) digital components that appear in publisher resources 145 and digital component slots in applications 112 . For example, digital component provider 160 may create a digital component that includes content related to digital component provider 160 . In certain examples, a product manufacturer's digital component may include content related to the product.

Digital component provider 160 can use DSP 150 to manage the provisioning of its digital components for display in digital component slots. DSP 150 is a technology platform implemented in hardware and/or software that automates the process of delivering digital components for display in resources and/or applications. A DSP 150 may interact with multiple SSPs 170 on behalf of a digital component provider 160 to provide digital components for display in multiple different publisher's 140 resources 145 and/or applications 112 . In general, DSP 150 receives requests for digital components (e.g., from SSP 170) and generates selection values for one or more digital components produced by one or more digital component providers 160 based on the requests (or selection), and data associated with the digital component (eg, the digital component itself or code that enables the digital component to be downloaded) and selection parameters can be provided to SSP 170 . A selection value may indicate an amount that the digital component provider 160 is willing to provide for display or user interaction with the digital component. The SSP 170 then selects the digital components for display on the client device 110 and provides data that causes the client device 110 to display the digital components, e.g., by providing the digital components or code that enables download of the digital components. can be provided to the client device 110. As described in more detail below, the MPC cluster 130 can select digital components for display by the client device 110 to preserve user privacy.

In some cases, it is beneficial for a user to receive digital components related to web pages, application pages, or other electronic resources that the user has previously visited and/or interacted with. In order to deliver such digital components to users, users may collect data from user groups, e.g., user interest groups of users interested in the same or similar topics, cohorts of similar users, or others involved in similar user data. group type. When a user visits a particular resource or performs a particular action on a resource (for example, interacting with a particular item displayed on a web page or adding an item to a virtual cart), the user can be assigned to groups. User groups may be created and updated by digital component providers 160 . That is, each digital component provider 160 can assign a user to a group of users of the digital component provider 160 when the user visits electronic resources of the digital component provider 160 . User groups may also be created and/or updated by the content platform, eg, by DSP 150 and/or SSP 170 .

To protect user privacy, a user's group membership is determined by, for example, the application 112, the operating system of the client device 110, or another trusted program, rather than by a digital component provider, content platform, or other party. may be maintained at the user's client device 110 by one of the In certain instances, a trusted program (e.g., a web browser or an operating system) may access a user using a web browser or another application (e.g., a user logged into the browser, application, or client device 110). ), a list of user group identifiers (a "user group list") can be maintained. The user group list may contain a user group identifier for each user group that has the user as a member. Digital component providers 160 or content platforms that create user groups can specify user group identifiers for those user groups. A user group identifier for a user group can be something that describes the group (eg, a gardening group) or a code that represents the group (eg, a non-descriptive alphanumeric sequence). User group lists for users may be stored in secure storage at client device 110 and/or may be encrypted when stored to prevent others from accessing the lists.

When application 112 displays a resource (e.g., web page), application content, or digital component on digital component provider 160, the resource, application content, or digital component is displayed by application 112 using one or more user group identifiers as user group identifiers. You can request to be added to the list. In response, application 112 can add one or more user group identifiers to the user group list and securely store the user group list. For example, a web page where a user chooses to view more information about a particular item may add the user to a user group associated with that particular item.

In some implementations, the MPC cluster 130 uses the user's user group members to select digital components that may be of interest to the user or otherwise beneficial to the user/user device. Ships can be used. For example, such digital components or other content may include data that improves the user experience, improves the performance of the user device, or benefits the user or client device 110 in some other way. OK. However, in a manner that prevents computing systems MPC1 and MPC2 of MPC cluster 130 from accessing the user group identifier for the user in plaintext, the user group identifier of the user's user group list is provided and used to select the digital component. can be used, thereby preserving user privacy when using user group membership data to select digital components. MPC cluster 130 may also select digital components using other criteria, as described in more detail below.

The secure MPC cluster 130 is based on the user's group membership, but without cleartext access to group membership information or other user information, or signals derived from such user information, to the user's client device. It includes two computational systems MPC1 and MPC2 that perform a secure MPC process to select digital components for delivery to. Although the exemplary MPC cluster 130 includes two computing systems, more computing systems can be used as long as the MPC cluster 130 includes two or more computing systems. For example, MPC cluster 130 may include three computing systems, four computing systems, or another suitable number of computing systems. Using more computing systems in the MPC cluster 130 can provide more security, but can also increase the complexity of the MPC process. Each computing system may be a server or other suitable type of computer. An exemplary architecture of the MPC computing system is shown in FIG.

Computing systems MPC1 and MPC2 may be operated by different entities. As such, each entity may not have plaintext access to a user's group memberships, or other user information, or signals derived from such user information. For example, one of computing systems MPC1 or MPC2 may be operated by a trusted party different from the user, publisher 140, DSP 150, SSP 170, and digital component provider 160. For example, an industry group, a government group, or a browser developer can maintain and operate one of the computing systems MPC1 and MPC2. Other computing systems may be operated by different ones of these groups, such as different trusted parties operating each computing system MPC1 and MPC2. Advantageously, different parties operating different computing systems MPC1 and MPC2 may have no motive to collude to compromise user privacy. In some implementations, computing systems MPC1 and MPC2 are architecturally separated and monitored from communicating with each other outside of executing the secure MPC processes described herein.

Each computing system MPC1 and MPC2 can store digital components (eg, creations of the digital components), selected values for the digital components, and other information for the digital components. For example, computational systems MPC1 and MPC2 have previously been received from SSP170 and/or DSP150 as part of a previous digital component selection process, or have been provided in advance for use in, for example, a digital component selection process. Selection values that have been provided to computing systems MPC1 and MPC2 in other manners can be cached. Thus, MPC cluster 130 can use the selection values to select digital components for delivery to client device 110 in response to future digital component requests received from client device 110 . Digital components whose selection values and other information are stored by the MPC cluster 130 for the digital component selection process may be referred to herein as stored digital components. However, the digital components themselves are not necessarily stored by MPC cluster 130 . Alternatively, the MPC cluster 130 can store data, eg, code, for each stored digital component that references a network location from which the digital component can be downloaded. In some embodiments, the digital component itself is stored and returned directly to application 112 by MPC cluster 130 . Such an implementation may cause the application 112 to consume the device's battery and bandwidth, and the server hosting the digital component itself may leak additional signals to track the device. and/or reduce the need to fetch other information for digital components.

For each stored digital component, each computing system MPC1 and MPC2 can store a selection value or vector of values that can be used by computing systems MPC1 and MPC2 to determine the selection value of the digital component. can. Each computing system MPC1 and MPC2 may also store, for each digital component, conditional data specifying conditions that must be met for the digital component to be a qualified candidate for a given digital component selection process. A stored digital component may have zero or more corresponding terms.

One exemplary condition is that the user to whom the selected digital component is provided is a member of the user group corresponding to the stored digital component. This condition can be referred to as a user group membership condition. In this example, computing systems MPC1 and MPC2 may store, for stored digital components, a set of one or more user group identifiers corresponding to the digital components. These user group identifiers identify user groups to which the stored digital components may be provided. That is, the stored digital component provides the digital component for provision to users who are members of at least one of the user groups identified by the set of one or more user group identifiers of the stored digital component. It is merely a candidate for the digital component selection process that is performed to select.

Another exemplary condition for digital components to be stored is a frequency cap condition that indicates that a digital component or a particular category of digital components can only be provided to the same user a certain maximum number of times over a given duration. be. Another exemplary condition for a digital component is a block digital component condition that indicates that the digital component has been blocked, eg, muted, by the user. For these exemplary conditions, computing systems MPC1 and MPC2, from a store, for each of a plurality of users, create probabilistic data structures, such as Cuckoo filters or Bloom filters, representing digital components that cannot be provided to users. can receive. For example, a probabilistic data structure can be a universal data structure for digital components that are blocked either directly by the user or because the frequency with which the digital component is displayed to the user is exceeded during a given duration. It can represent an identifier.

Computing systems MPC1 and MPC2 may receive from a user's client device 110, for example, a probabilistic data structure in encrypted form that prevents either of computing systems MPC1 and MPC2 from accessing the identifier in cleartext. For example, an application 112 running on a user's client device 110 can generate a bloom filter representing identifiers of blocked digital components that are blocked due to frequency capping or blocked by the user. Application 112 then causes computing systems MPC1 and MPC2 to jointly interrogate Bloom filters using a secure MPC process to determine whether a given digital component is blocked for that user. can be provided to each computing system MPC1 and MPC2. Calculation systems MPC1 and MPC2 use this secure MPC process to calculate the secret share of the block digital component terms. An exemplary process for creating and querying Bloom filters is described with reference to FIG.

In some implementations, block digital component identifiers can be contained within the same probabilistic data structure as user group identifiers and can be queried using different hash functions. However, the target false positive rate for block digital components can be lower than the false positive rate for user group identifiers. Thus, a Bloom filter of block digital components can be generated and queried using fewer hash functions than user group identifiers. To reduce the data size of the Bloom filter of the block digital component, the user group identifier can be represented by a different Bloom filter than the block digital component. This reduces latency in transmitting Bloom filters over the network, reduces bandwidth consumption in transmitting Bloom filters, and reduces battery power usage for transmitting Bloom filters.

Another exemplary condition for a stored digital component is a pacing condition that paces the delivery of the digital component over a period of time. Computing systems MPC1 and MPC2 may store data indicating the total number of times a digital component may be provided over a duration and/or the maximum budget for the digital component over that duration. Computing systems MPC1 and MPC2 can use this information to pace how often a digital component can be a candidate for the digital component selection process based on this condition (e.g., digital all conditions for the component must be met). In some embodiments, computing systems MPC1 and MPC2 implement feedback controllers, such as proportional-integral-derivative (PID) controllers, that use secret shares to pace stored digital components with pacing conditions. be able to.

In this example, the computing systems MPC1 and MPC2 can store the setpoints of the PID controllers for the digital components and maintain the measured variables of the PID controllers for the digital components. Generally, a PID controller is a feedback controller that uses an error value, which is the difference between the target setpoint and the measured variable, to determine the output that drives the measured variable towards the setpoint. In the context of pacing the delivery of digital components to client devices, set points for campaigns can be impression rates, interaction rates, conversion rates, and/or resource depletion rates (e.g., budget consumption rates). Similarly, the measured variable can be impression rate, interaction rate, conversion rate, and/or resource depletion rate over a given duration. Computing systems MPC1 and MPC2 can also store tuning parameters for each PID controller. Setpoints, measurement variables, and tuning parameters can be stored in secret shares (each computing system MPC1 and MPC2 stores the corresponding share of each parameter) or in plaintext, depending on the target privacy/data security.

Another exemplary condition is the k-anonymity condition. The k-anonymity conditions include k-anonymity rules that require the digital component to be eligible (or selected) for delivery to at least k users for a given duration. can be done. The concept of k-anonymity ensures that the data for a particular user is indistinguishable from the data of a threshold number k of other users. The system may, for example, ensure that a particular digital component is delivered to a client device 110 in response to a request for one or more digital components, and that the same digital component is delivered to at least k people within a particular time period. of users, or by at least k applications 112, may or have been displayed, k-anonymity rules can be enforced. In some implementations, each of the k applications 112 to which the digital component may or have been distributed should be for a different user. In this example, computing systems MPC1 and MPC2 may store a value k for the digital component and maintain the number of users to whom the digital component may have been distributed.

Determining the number of users for whom the digital component may have been displayed can include performing a counterfactual digital component selection process in parallel with each actual digital component selection process. In this counterfactual digital component selection process, all digital components are candidates if they satisfy all conditions except the k-anonymity condition. In the counterfactual digital component selection process, if a digital component is selected for at least k users or k applications 112, the digital component is visible to k users in the absence of k-anonymity conditions. There will be When this occurs, the digital components that satisfy the k-anonymity conditions (assuming other conditions for digital components, if any, are met) can be included in the actual digital component selection process, which is k. - does not contain digital components that do not meet the anonymity conditions;

In some implementations, each computing system MPC1 and MPC2 stores information about the digital components in a data structure that maps the digital components and their respective information to a set of context signals. For example, each digital component may be eligible for display in a presentation environment using resources and/or applications that include a set of contextual signals. Context signals may be, for example, the topic of the resource, the keywords found in the resource, the resource locator of the resource, the geographic location of the client device 110, the language setting of the application 112, the number of digital component slots of the resource, the type of digital component slots, and /or other suitable context signals may be included. Additionally, the digital component can have multiple corresponding selection values, one for each set of context signals. Using such a data structure allows computing systems MPC1 and MPC2 to identify digital components that are eligible for the digital component selection process. Computing systems MPC1 and MPC2 can use these conditions to identify digital components from those eligible digital components that are actually eligible candidates for selection in the digital component selection process. A set of context signals for use in determining whether a digital component is eligible enables computing systems MPC1 and MPC2 to search for eligible digital components using the digital component request context signals. It can be in the form of a search key that

Where a digital component is associated with a corresponding user group identifier that identifies an eligible user group for the digital component, the information can be stored using a lookup table (LUT). Using LUTs can provide some performance advantage, but other suitable data structures may also be used. The LUT applies the context signal, or a search key derived from the context signal, to a set of digital components such that the set of digital components is eligible for display according to other conditions described herein; and/or Map as that selection value or vector is eligible. Thus, the computing systems MPC1 and MPC2 can store multiple selection values for each digital component, eg, one for each set of context signals.

In some implementations, the search key is a hash-based message authentication code (HMAC) of the context signal. For example, the search key can be HMAC(URL, HMAC(language, location)), the parameter URL is the URL of the resource for which the digital component and the selection value are eligible, the parameter language is the digital component and the selection The application 112 designation language for which the value is eligible, and the parameter location is the geographic location for which the digital component and selection value are eligible. If the context signal of the digital component request matches these parameters, then the digital component and selection value mapped to the search key are eligible for the digital component selection process to select the digital component in response to the request. be. Other context signals can be used in addition to or instead of URL, location, and language.

To reduce the amount of bandwidth and latency used to send digital component requests over network 105, application 112 sends context signals to computing systems MPC1 and MPC2 rather than sending them to the same HMAC can be used to compute the search key. This also reduces the amount of battery consumed by client device 110 and the amount of data received by each computing system MPC1 and MPC2.

In some implementations, a two-level LUT table is used, for example, when the digital component is conditioned on the user's user group membership. The first stage may be keyed by a request key (UG_Request_Key). UG_Request_Key is the set of context signals, e.g., the set of context signals for a digital component request (e.g., URL, location, language, etc.), or the set of context signals for which a digital component is eligible for delivery. It can be a search key that is of the form: That is, the first stage LUT can be keyed based on a set of context signals. The first stage key can be a hash of UG_Request_Key, for example using a hash function such as SHA256. This key can be shortened to a specified number of bits, eg, 16 bytes, or another suitable number of bits. Each key UG_Request_Key value in the first stage LUT may indicate a row in the second stage LUT containing digital component data eligible for the digital component request containing the UG_Request_Key's context signal. An exemplary first stage LUT is shown below as Table 1.

The second stage LUT may be keyed based on the combination of the user group request key UG_Request_Key and the user group identifier in the first stage LUT. In some embodiments, the second stage LUT can be an array or other suitable data structure. Each row in the second stage LUT may be for a particular selected value (or vector of values) for a particular digital component. For example, DSP 150 may submit different selection values for the same digital component, each selection value for a different set of context signals and/or a different user group identifier. Accordingly, the selection value of the digital component may change based on the context and user group membership of the user for whom the digital component selection process is being performed.

DSP 150 or digital component provider 160 can associate, eg, link or map, the digital component to a group of users to whom DSP 150 or digital component provider wishes to have the digital component displayed. For example, the DSP 150 may desire that digital components related to fly fishing be displayed to those who have expressed an interest in fly fishing. In this example, DSP 150 may provide data to MPC cluster 130 indicating that the digital component corresponds to a user group identifier for a user group that includes people who have expressed an interest in fly fishing.

In some implementations, the key for a row in the second stage LUT is a hash or code generated based on the combination of the user group request key UG_Request_Key and the user group identifier for the row's digital component. could be. For example, the key can be the HMAC of the combination, which can be represented as HMAC _SHA256 (UG_Request_Key, ug_id). The user group identifier ug_id can be based on a combination of the internal user group identifier for the user group and the domain of the user group's owner (eg, the DSP, SSP, or digital component provider that owns the user group). For example, the user group identifier ug_id may be a digital digest of the owner's internal user group identifier for the owner domain's eTLD+1 and user group. eTLD+1 is the effective top-level domain (eTLD)+1 level above the public suffix. An exemplary eTLD+1 is "example.com", where ".com" is the top level domain. The ug_id may be shortened to 16 bytes or another suitable data size.

Continuing with our previous fly-fishing example, the second-stage search keys for rows containing information about digital components that will be displayed to users in that person's fly-fishing group are the user group request key UG_Request_Key and its UG_Request_Key. It can be combined with the user group identifier ug_id of the fly fishing group of people. Since the digital components can be presented in different contexts, the second stage lookup table is a digital component associated with the user group identifier ug_id of the person's fly fishing group, each with a different user group request key UG_Request_Key and a different value. can contain multiple lines of

The value for each row of the second stage LUT identifies the selected value (or vector of values) for the digital component, and other data for the digital component, such as the digital component or a network location from which the digital component can be downloaded. It can be metadata and the like. In some implementations, a row may contain the digital component itself ready to be rendered by the application 112, for example in a web package format.

Its value may be a digital component information element dc_information_element, which may be a byte array with selection values and metadata. The byte array may have a specific format that can be parsed by application 112 or trusted programs of client device 110 and computing systems MPC1 and MPC2 to obtain selection values and metadata. In some implementations, the digital component information element can include the digital component itself. An exemplary second stage LUT is shown below as Table 2. If a vector is used to determine the selection values, the selection values can be replaced with the vectors in Table 2.

A second stage LUT maps the selection value to a particular set of context signals defined by a particular digital component, a particular user group identifier ug_id, and a first stage search key UG_Request_Key. By doing so, the second stage LUT indicates the specific context of the digital component slot for which the selection value for the digital component is eligible. This allows DSP 150 or digital component provider 160 to specify different selection values for the same digital component for different contexts, defined by the context signal and the user's group membership. The user to whom the digital component is displayed is a member of a particular user group identified by a particular user group identifier ug_id, and in a particular context defined by the context signal of the first stage lookup key. Any digital component with selected values in a second stage LUT with a matching user group identifier and a matching first stage lookup key when a digital component request is received indicating that the component is to be displayed are candidates to be selected for delivery in response to the request.

In addition to the descriptions throughout this specification, any system, program, or feature described herein may provide user information (e.g., the user's social networks, social activities or activities, occupation, user preferences, or user Allows users to make choices regarding both whether and when collection of information about their current location) can be enabled, and whether content or communications from the server is sent to them The user may be provided with a control (eg, a user interface element with which the user can interact) that allows the user to. Additionally, some data may be processed in one or more ways before being stored or used such that personally identifiable information is removed. For example, a user's identity may be treated such that personally identifiable information cannot be determined about the user, or a user's geographic location may be obtained from location information such that the user's specific location cannot be determined. may be generalized (to city, ZIP code, or state level, etc.) Thus, the user can control what information is collected about the user, how that information is used, and what information is provided to the user.

FIG. 2 shows an exemplary data flow within environment 100 of FIG. This description describes two types of selected values: sensitive user information, such as user group membership or other company sensitive information, or changes in that value that allow an unscrupulous party to infer sensitive information. It includes selection values that are conditioned on parameters that may be used, or "conditional selection values," and selection values that are not conditioned on sensitive information, or "unconditional selection values." To protect user privacy, the conditions for the "conditional selection value" are evaluated within the MPC cluster 130 instead of the SSP 170 or DSP 150 to determine whether the "conditional selection value" is a candidate for the content selection process. is determined.

This structure allows MPC cluster 130 to protect user privacy and confidential business information and to prove its trustworthiness to application providers, such as the provider of application 112 . In this example, MPC cluster 130 relies on a secure two-party computing (2PC) architecture, which allows confidential user data or confidential trade information to be stored if at least one of the two computing systems of MPC cluster 130 is fair. apply cryptographic techniques to ensure that there is no leakage of If the MPC cluster 130 includes more than two computing systems, the current MPC protocol can be extended or other MPC protocols can be used.

The MPC cluster 130 executes a secure 2PC protocol to evaluate and apply conditions to select candidate digital components, performs a selection process to select digital components based on selection values, and if those conditions are Receive impression notifications to update dependent parameters. All of these processes can be done using secret sharing techniques. This protocol is described in detail with reference to FIG.

In phase A, application 112 sends a request for a digital component to MPC cluster 130 in cooperation with a triggering element from a content platform, such as SSP 170, for example. Application 112 may include multiple requests for digital components together in one combined request to fetch multiple digital components. The MPC cluster 130 can then independently serve each request in the combined request or collectively make one or more selection decisions. In this example, the request is for a single digital component and includes a request for the digital component to be selected based on sensitive information or selected without sensitive information. The MPC cluster 130 can respond to the request by selecting a particular digital component corresponding to a particular selection value in a set of selection values each mapped to a respective particular digital component. These selection values may be previously cached or otherwise stored selection values in MPC cluster 130 and/or selection values generated by a platform such as DSP 150 or SSP 170, just-in-time (JIT) selection. can be a value. JIT selection values are generated directly in response to need, increasing efficiency and reducing waste because selection values are generated only when digital components are needed. For example, a JIT selection value can be generated when a digital component slot becomes available, indicated by receipt of a request for the digital component. Thus, MPC cluster 130 is a digital component including the stored digital component whose information is stored in MPC cluster 130 and the digital component whose JIT selection value has been received for the current digital component request. You can choose a digital component from a set of

In some implementations, the selected values for the digital components can be determined using more than one vector. MPC cluster 130 may store, for a digital component, a first vector of values that may be used to determine a selected value for the digital component. The first vector of values may be specific to one or more user groups, e.g. Can be used to determine the selection value. Therefore, the first vector of values can also be referred to as a user group-based vector. A user group-based vector can include multiple elements spanning two or more dimensions, and each element can represent a particular characteristic of the digital component presentation opportunity. For example, a user group-based vector of values could be a geographic location or region, a language, an age or age range, a particular URL for a web page or other electronic resource, a particular product or service, a digital component slot on which to fold. is or is, the type of digital component slot, the size of the digital component slot, the number of digital component slots on the electronic resource, the time of day, the web feature identifier, and/or other suitable characteristics of the digital component presentation opportunity can contain elements of For example, in some implementations, such as implementations employing neural networks, the user group-based vector of values can be an embedding of the user group in some abstract vector space.

The value of each element can reflect an amount of increase or decrease in the selected value of the digital component based on current digital component presentation opportunities with the characteristics corresponding to the element. For example, if the DSP 150 wants the digital component to be displayed to users in Atlanta but not to users in Dallas, then the value of the Atlanta element can be a positive value greater than 1 and the value of the Dallas element can be positive. The value can be a positive value less than 1, such as 0, or a negative value, for example. As described in more detail below, the values of the user group-based vectors can be part of a vector dot product calculation for determining the selected values of the digital components.

The request includes information that may be sensitive, such as the user group identifier of the user group to which the application 112 is mapped or otherwise associated, as well as information from the application 112 regarding the context in which the digital component is presented and/or displayed. Contains information used in the digital component selection process, including non-sensitive information such as context signals. As described in more detail below, the design of system 110 improves protection of user data that may be sensitive or confidential.

A triggering element can be, for example, a tag that detects the presence of a digital component slot within an Internet location visited by application 112 . A trigger element can be located, for example, at its Internet location, and can notify application 112 of the existence of a digital component slot in which a digital component should be requested.

At phase B, MPC cluster 130 sends to SSP 170 a digital component request based on non-sensitive information such as context signals. This request is referred to as a "context request". Contextual requests can include various contextual signals and non-sensitive user information collected directly by the Internet location (eg, content publisher) that triggered the request for the digital component. For example, context signals may include analytical data, language preferences, and other data that assist content publishers in providing a good user experience. However, context requests provided to SSP 170 do not contain sensitive information such as user group identifiers.

At phase C, SSP 170 forwards the context request to one or more DSPs 150 . In this particular example, the SSP 170 forwards the context request to a single DSP 150 for simplicity. For example, SSP 170 can forward the context request to DSP 150 . In this example, the DSP 150 may have the digital component and the selected value mapped to the digital component, or use the context signal to determine the selected value of the digital component.

At stage D, one or more DSPs 150 return selection values in response to the context request. For example, DSP 150 responds to context requests by returning one or more selection values that are mapped to digital components. DSP 150 can return any number of selection values in response to a context request. In some implementations, DSP 150 may additionally return selected values in response to digital component requests based on sensitive information, such as user group information. These selection values are "conditional selection values" because they are conditioned on sensitive information and are therefore conditioned on MPC clusters 130 that receive requests containing sensitive information that match the sensitive information on which the selection values are conditioned. is. For each selection value that DSP 150 provides, DSP 150 includes information such as a time-to-live (TTL) parameter, ie, the maximum time period that MPC cluster 130 can cache the selection value. This TTL parameter allows MPC cluster 130 to cache selection values received from DSP 150 . In some embodiments that do not use the TTL parameter, the MPC cluster 130 does not cache received selection values, instead the selection values correspond to digital component requests sent in stages A, B and C, for example. Discard the selection value after it has been used in a selection process, such as a selection process that

When a vector is used to determine selection values, DSP 150 may generate and return a second vector of values. DSP 150 may generate a second vector of values based on the context signal of the digital component request sent in stages B and C. FIG. A second vector can be referred to as a context vector. The context vector can contain the same elements that correspond to the same features as the user group-based vector. However, DSP 150 can determine the value of the context vector for the current digital component request based on the digital component request's context signal. In contrast, the user-group-based vector values of DSP 150 are stored as MPC clusters 130 and are predetermined, eg, based on the user group corresponding to the user-group-based vector.

For each DSP 150 that provides a context vector, MPC cluster 130 determines the selected value for each stored digital component of DSP 150 by determining the dot product of the user group-based vector and the context vector provided by DSP 150. be able to. If DSP 150 has multiple user-group-based vectors stored by MPC cluster 130, for example, for different digital components, MPC cluster 130 stores a context vector and a user-group-based vector for each user-group-based vector. Determines the dot product of vectors.

In some implementations, a third vector can be used based on the user profile of the user to whom the digital component request is submitted. This vector can have the same dimensions and characteristics as the other vectors, but has values based on the user's user profile.

For example, the value of the Austin location element in the user profile vector can have a positive value if the user is in Austin, or a negative value or a value of 0 if the user is not in Austin. and the value of the same location element in the context vector can have a positive value if the publisher content currently being shown to the user is highly relevant to Austin, and the user group-based vector of digital components The value of the same position element in is positive if the digital component is associated with Austin. To compute the dot product of three vectors, computing systems MPC ₁ and MPC ₂ first perform element-wise multiplications between corresponding elements, one from each of the three vectors, and then Sum the results. For example, if the three vectors are respectively V ₁ ={v _1,1 ...v _1,n }, V ₂ ={v _2,1 ...v _2,n } and V ₃ ={v _3,1 . ..v _3,n }, the dot product between the three vectors is:

At stage E, SSP 170 applies content selection rules to digital components corresponding to conditional selection values. As noted above, these conditions can be based on user group identifiers, frequency control, block (eg, mute) digital components, pacing, and/or k-anonymity.

SSP 170 also applies selection value rules, for example, to determine how selection values affect post-publication values for a particular content provider. The post-publication value can indicate, for example, the amount provided to the publisher 140 for display of the digital component along with the publisher's 140 resource or application content. SSP 170 then performs a selection process to determine the top unconditional selection value, ie, the unconditional selection value that yields the highest post-issuance value. Unconditional selection values are not conditioned on sensitive information, so content selection rules such as budget and pacing rules, advertiser and digital component exclusions can be applied by SSP 170 rather than MPC cluster 130 . The SSP 170 then finds the following JIT selection values: all selection values that enable caching in the MPC cluster 130 (selection values with TTL values), and their post-emission value is the top unconditional selection All selected values that are greater than or equal to the post-published value of the value are forwarded to the MPC cluster 130 .

In phase F, the MPC cluster 130 updates its cache with the received JIT selection values that enable caching (ie, have TTL values). In addition, the MPC cluster 130 blocks user group membership rules, frequency controls, pacing rules, and micro-targeting to all received and previously cached selection values in phase E for a particular user. Apply selection rules, such as the rule for , to select valid candidates for the selection process. Regulations can include, among other factors, restrictions and guidelines on the manner or frequency of distribution of digital components. Rules include frequency control, muting, resource exhaustion, and pacing constraints. In some implementations, JIT digital components with conditions evaluated by the MPC cluster 130 can be ignored for the current digital component selection process. For example, ignoring these digital components for the current selection process can provide performance benefits, such as reduced latency in selecting and providing digital components. The MPC cluster 130 then performs a final selection process among all eligible candidates and selects the winning selection value, which is then mapped to the winning selection value in response to the digital component request. Return digital component data to application 112 .

At stage G, the digital component mapped to the winning selection value is rendered by application 112 . Application 112 then provides the impression notification to MPC cluster 130 . This impression notification causes the MPC cluster 130 to update information related to update parameters that enable the MPC cluster 130 to enforce selection rules for future digital component requests received in subsequent occurrences of Phase A, for example. contains data that allows you to In some implementations, the application 112 piggybacks on future component requests A to reduce the number of network communications and mobile device battery/bandwidth consumption, as well as the MPC cluster 130 processing/computation costs. , an impression notification G can be sent to the MPC cluster 130 .

FIG. 3 is a swimlane diagram of an exemplary process 300 for selecting digital components for delivery to client devices. The operations of process 300 may be performed by client device 110, computing systems MPC1 and MPC2 of MPC cluster 130, and DSP 150, for example. The operations of process 300 may be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, and execution of the instructions by one or more data processing devices may occur in one Or, multiple data processing devices may perform the operations of process 300 . Although process 300 and other processes below are described with respect to an MPC cluster 130 of two computing systems, MPC clusters with more than two computing systems can also be used to perform similar processes. Additionally, the operations of process 300 may be performed by SSP 170 .

The exemplary process 300 includes tiers, boosts, first value selection processes (eg, first price auctions), second value selection processes (eg, second price auctions), floors, and the like. can include variations of Each of these variations is described with reference to FIGS. 3-5.

In general, boost is the amount by which the selected value of the digital component is adjusted. For example, a content publisher may instruct the SSP 170 to give a specified amount of 'x' boost to a particular DSP 150 when a digital component is selected for display with one of the publisher's resources 145 or application content. can give instructions. If the DSP 150 submits a selection value of 'y', the selection value used in the digital component selection process will be x+y. However, DSP 150 is only required to provide quantities less than or equal to y in the first selection value or second selection value process when a digital component is selected. In process 300 , MPC cluster 130 may apply boosts to selected values according to information provided by SSP 170 . For example, each SSP 170 may provide information mapping boosts to DSP 150 and publisher 140 pairs. That is, the information indicates that a particular DSP's selection value should be boosted by a particular amount for the digital component selection process that is selecting digital components for display with content from a particular publisher. be able to. In some implementations, the SSP/publisher can support boosting at a more granular level. For example, for each search key (eg, for each set of context signals) the SSP/publisher can specify a boost.

SSP 170 may direct secure MPC cluster 130 to partition DSP 150 into multiple tiers with different priorities. Rather than selecting the digital component corresponding to the highest selection value among all candidate digital components in the digital component selection process, the digital component with the highest selection value within the highest priority hierarchy is selected. To illustrate, consider an example where there are two tiers, the highest tier and the lowest tier. If there is one or more candidate digital components in the highest tier, even if the candidate digital component in the lowest tier has a higher selection value than all candidate digital components in the highest tier , the candidate digital component with the highest selection value in the highest hierarchy is selected.

The main difference between the first value selection process and the second value selection process is the amount of clearing of the selected digital component. A clear amount is an amount that needs to be provided by DSP 150 to publisher 140 and/or SSP 170 for display of the digital component. The same digital component is selected using both processes. In the first value selection process, DSP 150 is required to provide publisher 140 and/or SSP 170 with an amount equal to the selection value submitted by DSP 150 . In the second value selection process, DSP 150 is asked to provide a quantity based on the second highest selected value instead. If a hierarchy is used with the second selection value process, the second highest value will be the second highest value within the same hierarchy as the selected digital component. If there are no such candidate digital components in the same hierarchy, the second highest value may be the minimum value of the digital component selection process.

A selection value floor may indicate the minimum selection value that the publisher 140 is willing to allow for display of the digital component. The publisher 140 has various DSPs 150, digital components for each category (e.g. one floor for digital components related to automobiles and another floor for digital components related to gardening), each digital component provider 160, each brand, publisher A selected value floor can be specified for each page, each digital component slot, group of digital component slots, and/or group of other types of digital components on the site of . In some embodiments, SSP 170 may set the floor in advance or on behalf of publisher 140 for each digital component request in phase A, for example.

DSP 150 provides additional information (eg, selection criteria, such as conditions) regarding selection values and digital components to MPC cluster 130 (302). In some embodiments, DSP 150 provides selection values and additional information to MPC cluster 130 via an SSP (not shown in FIG. 3 for simplicity). For example, DSP 150 responds to a digital component request by providing selected values and additional information, and designates the digital component corresponding to the selected value as a stored digital component that should have been stored in MPC cluster 130. can do.

MPC cluster 130 can store selection values and selection criteria for future digital component requests received from client device 110 . For each digital component, DSP 150 can also upload additional data, eg, metadata, for the digital component. Additional information about the digital component may include one or more conditions (and parameters of the conditions) that must be met for the digital component to be included in the digital component selection process. For example, the additional information can include one or more user group identifiers of user groups corresponding to the digital component.

Additional information about the digital component may include the context for which the digital component is eligible, such as the location of the client device 110, the language selected for the application 112, the URL of the resource with which the digital component may be presented, and /or may include a context selection signal that indicates an excluded URL for a resource with which the digital component may not be presented. Additional information about the digital component may also identify the digital component using, for example, a unique identifier, the domain from which the digital component may be obtained, and/or other suitable data for the digital component. . This additional information may be included as metadata for the digital component.

In some embodiments, MPC cluster 130 caches or otherwise stores selection values, selection criteria, and other information for digital components provided to MPC cluster 130 for digital component requests. . In this example, the context signal for the digital component and selection value can include the context signal included in the digital component request. As noted above, selection values and metadata can be stored in a two-stage LUT.

In some implementations, the DSP 150 can provide a user group-based vector of digital component values instead of statically selected values for the digital components. In such an example, a user group-based vector of values can be stored instead of the selection values.

Client device 110 receives the content (304). For example, client device 110 can receive electronic resources (eg, web pages) for display by a web browser or application content for display by native applications. The content may include one or more digital component slots containing computer readable code, eg, a script that, when executed, causes client device 110 to request a digital component for each slot. A client device 110 can render content on a display of the client device 110 .

The client device 110 identifies (306) a set of user group identifiers. A set of user group identifiers may be user group identifiers of user groups that include the user as a member. For example, the set of user group identifiers may be user group identifiers in a user group list. An application 112 or trusted program rendering content may identify the set of user group identifiers, for example, by accessing the user group list from secure storage of the client device 110 .

Client device 110 generates a probabilistic data structure (308). To securely and efficiently generate digital component requests based on sensitive information, application 112 may use probabilistic data structures, such as Cuckoo filters or Bloom filters. In this example, the probabilistic data structure is a cuckoo filter. An example using Bloom filters is described with reference to FIG. In general, a Cuckoo filter contains an array of buckets, each of which can hold b fingerprints. An item's fingerprint is a string of bits derived from the hash of that item. The Cuckoo filter uses n hash functions that allow items to be placed in n different buckets at any of b positions. Typically, Cuckoo filters are identified by the number of fingerprints in each bucket and the number of buckets. For example, a (2, 4) Cuckoo filter has 2 buckets and each bucket in the Cuckoo array can store up to 4 fingerprints. The total capacity of the Cuckoo filter is therefore 2 x 4 or 8 fingerprints.

Depending on the configuration of the Cuckoo filter, an item can be inserted into the Cuckoo filter in one of N possible positions, eg N=2. Application 112 uses N pseudorandom functions (PRFs) parameterized by an identifier from a user group identifier or a set of blocked identifiers and one of two random variables generated by application 112 to Determine all possible positions where the item will be inserted. For example, assume two random variables generated by application 112 are rand_var1a and rand_var1b. In some implementations, application 112 and MPC cluster 130 pre-agreement on the PRF, where PRF(x,y) ∈ [0,2 ^k −1], where k is each item in the bucket of the cuckoo filter. is the number of bits in

Each position of the cuckoo filter may be occupied by a user group identifier or blocked identifier, or may be empty. A blocked identifier is an identifier for which application 112 has blocked a digital component, eg, based on frequency control, or an identifier for which a user has chosen to block a digital component for a group of users. Application 112 can generate a cuckoo filter table whose elements are PRF(ug_id, rand_var1a), PRF(blocked_uid, rand_var1b), and 0, where ug_id is the is the user group identifier generated by applying HMAC to the label, blocked_uid is an identifier from the set of blocked identifiers, and 0 represents an empty item. The process is repeated for all user group identifiers. In some implementations, the same probabilistic data structure, such as a Cuckoo filter or a Bloom filter, can store both user group identifiers and blocked identifiers. In another embodiment, user group identifiers and blocked identifiers are stored in dedicated probabilistic data structures.

Application 112 may generate vector B based on a cuckoo filter table generated for user group identifiers and/or blocked identifiers. each value B in vector B_iis B_i = (A_i- PRF(rand_var2, i)) mod p, where A is the Cuckoo filter table and i is the vector B and the Cuckoo filter table A index. When application 112 initiates a request for a digital component in a digital component slot, application 112 sends rand_var1a, rand_var1b and rand_var2 as parameters of the request to computing system MPC1. Application 112 also sends vector B, rand_var1a and rand_var1b as parameters of the request to computing system MPC2. PRF(rand_var2, i) and B_iare maintained by computational systems MPC1 and MPC2, respectively, Z_pA in_iis the two additive secret shares of . Since neither computing system MPC1 nor MPC2 has access to both secret shares, neither of these computing systems can recreate the Cuckoo filter table while preserving user privacy.

Client device 110 sends (310) to MPC cluster 130 a digital component request that includes the parameters of the cuckoo filter. For example, client device 110 may send computing system MPC1 a digital component request that includes rand_var1a, rand_var1b, and rand_var2. Client device 110 may also send computing system MPC2 a digital component request that includes vector B, rand_var1a and rand_var1b. Both digital component requests can also be used to select, for example, the URL of the electronic resource, the number of digital component slots in the resource, the geographic location of the client device 110, and/or the digital component. Context signals may also be included, such as other suitable context signals such as search keys.

MPC cluster 130 sends a contextual digital component request to SSP 170 (312). This digital component request may contain context signals, but does not contain sensitive user data such as a user group identifier that identifies the user group of which the user is a member. In some implementations, the contextual digital component request was generated by the SSP's tag on the publisher's page being rendered on the client device 110 . Application 112 sends a contextual digital component request to SSP 170 via MPC cluster 130 by piggybacking on the digital component request sent in operation 310 . In some implementations, application 112 encrypts the context digital component request using SSP 170's public key and piggybacks on the digital component request sent in operation 310 to encrypt the context digital component request. SSP 170 so that no one but SSP 170 can decode the context digital component.

SSP 170 sends a contextual digital component request to one or more DSPs 150 (314). Each DSP 150 can respond to requests with one or more conditionally selected values for the digital component and/or one or more unconditionally selected values for the digital component. For each digital component, the response may include data identifying the digital component, selected values for the digital component, and metadata (or other additional information) for the digital component. For example, the response may include a digital component information element dc_information_element for each digital component. Each DSP 150 can select one or more digital components for inclusion in the digital component selection process based on the context signal and determine or identify a selection value for each selected digital component. In some implementations, DSP 150 may generate a context vector for each of one or more digital components based on the context signal.

Each DSP 150 may send its response to SSP 170 (316). SSP 170 may send the response to MPC cluster 130 (318). In some implementations, SSP 170 may apply one or more floors to the digital component selection process before sending the response to MPC cluster 130 . The SSP 170 may apply the floor based on the electronic resource publisher 140 whose digital component is selected. As discussed above, publishers 140 may designate floors for DSPs 150, categories of digital components, digital component providers 160, brands, and/or groups of other types of digital components.

SSP 170 can identify the floors specified by publisher 140 and apply them to the selection values received from DSP 150 . If the selection value is less than the corresponding floor, SSP 170 may remove the selection value from the digital component selection process by, for example, not providing the selection value to MPC cluster 130 . For example, assume a publisher 140 has specified 5 units of floors for a given digital component provider 160 . If DSP 150 provided a selection value of 4 units for a digital component of a given digital component provider 160, SSP 170 can filter the selection value from the digital component selection process.

As described above, the DSP 150 can provide stored digital component selection values that are stored for use in future digital component processes. If these selection values do not fill the corresponding floor, the digital components and their associated selection values are not stored in MPC cluster 130 because SSP 170 does not forward them to MPC cluster 130 .

In some embodiments, MPC cluster cluster 130, rather than or in addition to SSP 170, enforces the floor. Because MPC cluster 130 computes the dot product of vectors when vectors are used to determine selection values, MPC cluster 130 can enforce floors on these selection values. For example, the MPC cluster 130, rather than the SSP 170, can also enforce floors for static selection values.

MPC cluster 130 performs a secure MPC process to select digital components to provide for display on client device 110 (320). This selection is based on the context signal using a search key, such as the first stage search key described above with reference to FIG. It can include identifying a corresponding selection value. This can also include identifying candidate digital components that are candidates for selection from the set of digital components. Candidate digital components can include unconditional digital components for which DSP 150 has provided selection values, and conditional digital components for which each condition of the digital component is satisfied. A conditional digital component is considered a candidate for the digital component selection process only if all the conditions of the digital component are met.

MPC cluster 130 may select from the candidate digital components a digital component for provision to client device 110 in response to the digital component request based on the selection values of the candidate digital components. For digital components with selected values determined using vectors, the MPC cluster 130 determines the dot product of vectors such as, for example, a user group-based vector, a context vector, and optionally a user profile vector. can determine the selected value of the digital component.

In selecting digital components, the MPC cluster 130 can also consider any hierarchy or boost of digital components. As noted above, publisher 140 may establish a hierarchy and/or boost of DSPs 150 and/or digital component providers 160 . If the publisher 140 whose digital component is selected establishes a boost, the MPC cluster 130 (or SSP 170) uses the corresponding boost specified by the publisher 140 to boost the digital component of the DSP 150 and/or the digital component provider 160. can be adjusted. If a vector is used to determine the selection value, MPC cluster 130 can adjust the selection value after the selection value is determined by computing the dot product of the vectors.

If hierarchies are used, the MPC cluster 130 may perform the selection process for each hierarchy, eg, from highest priority hierarchy to lowest priority, either sequentially or in parallel. MPC cluster 130 may select the digital component with the highest selection value in the highest priority hierarchy that contains at least one candidate digital component. For example, if none of the digital components in the highest priority hierarchy are candidates that meet all of their conditions for inclusion in, for example, the digital component selection process, the MPC cluster 130 selects the next highest priority containing candidates. Select a candidate from a hierarchy.

MPC cluster 130 may perform the selection process for each layer in parallel to improve the speed at which the selection process is performed. Thus, if there are no candidates in the highest priority tier, the MPC cluster 130 has already begun and may have completed the selection process for each other tier, resulting in the last digital component being selected. can be

MPC cluster 130 may perform the selection process sequentially from the highest priority tier to the lowest priority tier. If speed is less important, this can reduce the wasteful computations performed on the lowest priority tier when the highest priority tier contains the candidate digital component. An exemplary process for selecting digital components using the secure MPC process is shown in FIG. 4 and described below.

MPC cluster 130 sends the resulting secret share to client device 110 (322). In some implementations, MPC cluster 130 may also transmit a selection process identifier for the digital component selection process to client device 110 . A selection process identifier may uniquely identify the digital component selection process from which the selection results were generated. For example, computing systems MPC1 and MPC2 each perform a selection process for generating a selection result for computing systems MPC1 and MPC2 to provide to client device 110 for each digital component request. An identifier SPID can be generated. In some embodiments, the selection process identifier SPID can be a nonce or an opaque alphanumeric or numeric string.

The MPC cluster 130 may also store data for selection values that were part of the selection process that were keyed by the SPID or otherwise linked to the SPID. For example, computing system MPC1 may store a table or other data structure containing data for selection values with keys based on SPID ₁ generated by computing system MPC1 for the selection process. Similarly, computing system MPC2 may store a table or other data structure containing data for selection values with keys based on SPID ₂ generated by computing system MPC2 for the selection process. This allows the MPC cluster 130 to update process variables for the feedback controller based on data received from the client device 110 .

The selection result may be in the form of a byte array containing information about the digital component selected. For example, the selection result may be a byte array containing values for the digital components in the second LUT, eg, selection values for the digital components and metadata for the digital components. Computing systems MPC1 and MPC2 may use a secure MPC process to determine the secret share of the selection result, as described in more detail below. Computing system MPC1 may transmit a first secret share of the selection result to client device 110 and computing system MPC2 may transmit a second secret share of the selection result to client device 110 . To prevent computing systems MPC1 and MPC2 from knowing the selected digital component, computing systems MPC1 and MPC2 may be prevented from sharing with each other their secret share of the selection result.

Client device 110 determines (324) a digital component corresponding to the selection result. For each selection result for which client device 110 receives two secret shares from computing systems MPC1 and MPC2, client device 110 can determine the selection result from the two secret shares. For example, using an additive secret share library as described in more detail below, the client device 110 can add together two secret shares of the selection result to obtain the selection result in plaintext. This gives the client device 110 access to selection values for the digital component and metadata for the digital component, such as identification of the digital component, locations from which the client device 110 can download the digital component, and the like. .

Client device 110 displays 326 the digital component. For example, application 112 may display the digital component with the content received at step 304 . In some implementations, client device 110 can display a digital component of the selection results.

In some implementations, client device 110 can request digital components based on user group membership from MPC cluster 130 . Client device 110 may also request digital components based on context signals from SSP 170 . These context signals may be the same context signals described above, and optionally additional information such as the number of digital component slots for the resource, the type of digital component slots, the type and/or format of the digital components that may be displayed with the resource. context signal. The SSP170 is capable of selecting one or more digital components based on the context signal and selection values for the digital components, and determining the selected digital components (or data identifying the digital components) and the selection values for the digital components. One or more of which may be provided to client device 110 . Client device 110 may then select a digital component for display with the resource from a set of digital components, including the digital component of the selection result received from MPC cluster 130 and the digital component selected by SSP 170 . can. If a resource includes multiple digital component slots, client device 110 can request a respective digital component from MPC cluster 130 and SSP 170 for each slot.

Client device 110 sends one or more event notifications to MPC cluster 130 (328). For example, assuming that the digital components of the selection results received from the MPC cluster 130 are displayed by the application 112 on the client device 110, the application 112 will send an impression notification of the digital components in response to the display of the digital components. can be done. In another example, application 112 can send a user interaction notification in response to detecting a user interaction such as, for example, selecting/clicking a digital component.

For user interaction notification, application 112 can have a value of 1 if the user has interacted with the digital component, or if the user has interacted with the digital component within a specified duration of time after the digital component is displayed. We can generate a secret share for the click parameter clicked, which is a boolean parameter that can have a value of 0 if it wasn't there. Thus, in this example, any value indicates that the digital component is displayed, but a value of 1 can indicate that the user has interacted with the digital component. Application 112 may send computer system MPC1 a first notification that includes SPID ₁ and a first secret share of click parameters [clicked ₁ ] received from computing system MPC1. Similarly, application 112 may send computer system MPC2 a second notification including SPID ₂ received from computing system _MPC2 and a second secret share of click parameters [clicked ₂ ]. In another example, the notification can separately indicate whether or not the digital component was displayed at the client device 110, eg, using secret shares similar to click parameters.

Impression and user interaction notifications enable the MPC cluster 130 to update process variables in feedback controllers used to pace the delivery of digital components. For example, if the process variable is impression rate, the MPC cluster 130 can use impression notifications to update the count of impressions for the digital component (or campaigns containing the digital component). If the process variable is user interaction rate, the MPC cluster 130 can use the click parameter to update the number of user interactions for the digital component (or campaign containing the digital component). In a particular example, computing system MPC1 can use SPID ₁ to obtain the stored data of the selection process, and computing system MPC2 can use SPID ₂ to obtain the stored data of the selection process. data can be obtained. The MPC cluster 130 then implements a secure MPC process to update process variables (eg, impression rate, interaction rate, conversion rate, and/or resource exhaustion rate) of digital component campaigns displayed by application 112. be able to. Similarly, MPC cluster 130 can use these notifications to update counts used to determine whether a digital component satisfies the k-anonymity condition.

FIG. 4 is a swimlane diagram of an exemplary process 400 for selecting digital components for delivery to client devices. The operations of process 400 may be performed by computing system MPC1 or computing system MPC2 of MPC cluster 130, for example. The operations of process 400 may be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, and execution of the instructions by one or more data processing devices may occur in one Or, multiple data processing devices may perform the operations of process 400 .

The process 400 can be used for a first value selection process, a second value selection process, and/or a selection process involving boost and/or floor. Each of these variations is described below. Another example process 500 shown in FIG. 5 can be used for a selection process involving hierarchy. Process 500 may also support a first value selection process, a second value selection process, a boost, and/or a floor.

Computing systems MPC1 and MPC2 determine and/or identify selected values for digital components (402). Computing systems MPC1 and MPC2 may determine the selection values in response to digital component requests received from client device 110 . As described with reference to FIG. 3, computing system MPC1 receives from client device 110 a context signal and a digital component request including data in a probabilistic data structure representing a user group identifier of a user of client device 110. can do. The data of the probabilistic data structure can include the parameters rand_var1a, rand_var1b and rand_var2. Similarly, computing system MPC2 may receive context signals and parameters from client device 110: vector B, rand_var1a and rand_var1b. The context signal may be, for example, in the form of a search key, such as the first stage search key (SHA256 (UG_Request_Key)) described with reference to FIG.

The selection values may include stored digital component selection values whose data is stored by each computing system MPC1 and MPC2, as well as JIT selection values received from SSP 170 for the digital component selection process. For situations where the selection value is determined using a vector, each computing system MPC1 and MPC2 can determine the selection value by determining the vector dot product of the digital components. Computing systems MPC1 and MPC2 may also apply any boost of digital components to which publisher 140 or SSP170 has established a boost and/or enforce any floors established by publisher 140 or SSP170. can.

Computing system MPC1 identifies (404) eligible digital components. Computing system MPC1 may, for example, identify eligible digital components for digital component requests received from client device 110, as described with reference to FIG. An eligible digital component is a digital component that is eligible for selection based on the context signal of the digital component request. For example, a qualified digital component may be a digital component that has a set of context signals that match the context signals of the digital component request, eg, a digital component that has a search key that matches the search key of the request.

In embodiments where a two-stage LUT is used, computing system MPC1 can use the first-stage search key of the digital component request to identify eligible digital components. Computing system MPC1 accesses the first-stage LUT and uses the first-stage search key to display, for a set of context signals represented by the first-stage search key, e.g. Rows of the second stage LUT can be identified that contain information about the digital components that are eligible to be processed. For example, as described above, each row of the second stage LUT contains information about the digital component and a second stage search key based on a set of context signals. Accordingly, computing system MPC1 uses the first-stage search key to generate a second-stage LUT having a set of context signals that match the set of context signals defined by the first-stage search key received in the digital component request. rows can be identified. These rows contain information about digital components that are eligible to be displayed or have selected values that are eligible for the context defined by the first stage search key received in the digital component request.

Computing system MPC2 identifies (406) eligible digital components. Computing system MPC2 may identify eligible digital components for digital component requests received from client device 110 . Computing system MPC2 can identify eligible digital components in a manner similar to computing system MPC1. In embodiments where the MPC cluster 130 enforces a floor, each MPC computational system MPC1 and MPC2 selects from the eligible digital components any eligible having a selection value that does not satisfy, e.g., does not satisfy or exceed, its corresponding floor. digital components can be filtered.

For each eligible digital component, computing systems MPC1 and MPC2 respond to the digital component request to determine whether the digital component and its selected value are candidates for selection for delivery to client device 110. Determine (408). A candidate digital component is an eligible digital component that satisfies all of the one or more conditions for the digital component if the digital component is a conditional digital component. Each unconditional digital component that qualifies based on the context is also a candidate digital component. Computing systems MPC1 and MPC2 may determine candidate digital components using a secure MPC process such that none of computing systems MPC1 and MPC2 can identify candidate digital components in plaintext.

For user group membership conditions, computing systems MPC1 and MPC2 can compute respective secret shares of user group membership condition parameters ug_check _i for each eligible digital component 'i'. The first secret share of the user group membership condition parameter ug_check _i maintained by computing system MPC1 can be represented as [ug_check _i,1 ] and the user group membership condition parameter ug_check _i maintained by computing system MPC2. The second secret share of can be represented as [ug_check _i,2 ]. Parentheses are used to denote secret shares of parameters.

For embodiments in which a cuckoo filter is used to represent a user's user group membership, computing system MPC1, in cooperation with computing system MPC2, computes [ug_check _i,1 ] according to Relation 1 below.

In relation 1, Π denotes multiplication of multiple items. where ug_id(x) is the function used to retrieve the user group identifier ug_id associated with the selection value x and {F ₁ ,...F _N } are the possible A set of hash functions to compute the index, rand_val1a is the random value received in the digital component request. [M _x,1 ] is the xth element in the array [M ₁ ]. == is an equality test between a plaintext integer and a secret share of a secret integer. The result of == is the secret share of secret integers that are either 0 (not equal) or 1 (equal). where the value of [M _i,1 ]=[PRF(rand_val2a, i) ₁ ].

Similarly, computing system MPC2, in cooperation with computing system MPC2, computes [ug_check _i,2 ] according to Relation 2 below.

where the value of [M _i,2 ] = B _i .

For a digital component whose digital component is conditioned on user group membership of the selected user, computing systems MPC1 and MPC2 compute the secret shares of user group membership condition parameters ug_check _i [ug_check _i,1 ] and [ ug_check _i,2 ] can be computed. The combination of the two secret shares can be a Boolean value representing whether the user is a member of the user group corresponding to the digital component. For example, a value of 1 can represent that the user is a member and a value of 0 can represent that the user is not a member. For digital components that are not conditioned on the user's user group membership, computing systems MPC1 and MPC2 generate a value (e.g., 1) that indicates that the user is a member of the user group corresponding to the digital component. The default values for secret shares [ug_check _i,1 ] and [ug_check _i,2 ] can be used to have.

In embodiments where Bloom filters are used to represent user group memberships of users, computing systems MPC1 and MPC2 can query the Bloom filters as described with reference to FIG. The result is that the computing system MPC1 has a first secret share of user group membership condition parameters [ug_check _i,1 ] for each hash function of the Bloom filter. Similarly, the computing system MPC2 has a second secret share of user group membership condition parameters [ug_check _i,2 ] for each hash function of the Bloom filter. It follows that for a digital component to satisfy the user group membership condition, the user group membership condition parameter of each hash value of the bloom filter, ie _{ug_checki} , must have a boolean value of true, ie 1. The secret share of each hash value may be included in the final computation of the secret shares of the candidate parameters of the digital component.

Computing systems MPC1 and MPC2 also cooperate to compute the respective secret shares [blocked_check _{i ,1} ] and [blocked_check _i,2 ] can also be calculated. The combination of the two secret shares is based on a frequency control (e.g., the digital component has not been provided to the user more than a threshold number of times during a certain duration) and/or the user decides that the digital component It may be a Boolean value representing whether or not the digital component satisfies the block digital component condition based on whether or not it has been chosen not to be displayed. For example, a boolean value of true or 1 can represent that the digital component can be displayed to the user based on these factors, and a boolean value of false or 0 can represent It can indicate that the digital component cannot be displayed to the user.

To determine the secret shares of the block digital component parameters, the computing systems MPC1 and MPC2 can use shares, eg arrays, of bloom filters representing the identifiers of the block digital components. Application 112 may generate Bloom filters representing identifiers of block digital components and send data representing the Bloom filters to computing systems MPC1 and MPC2, as described with reference to FIG. Computing systems MPC1 and MPC2 then query Bloom filters using arrays representing Bloom filters to obtain secret shares [blocked_check _i,1 ] and [blocked_check _{i, 2} ] can be obtained.

Computing systems MPC1 and MPC2 also cooperate to calculate, for example, respective secret shares of the pacing control check parameter pacing_check _i for each digital component i that is paced using a feedback controller [pacing_check _i,1 ] and [ You can also compute the spacing_check _i,2 ]. The combination of the two secret shares can be, for example, a Boolean value representing whether or not the digital component satisfies the pacing condition based on the output of the feedback controller. For example, if a digital component is being served too frequently in relation to a target impression rate, the output of the feedback controller can indicate that the digital component is not eligible for this digital component selection process. A boolean value of true or 1 can represent that the digital component satisfies the pacing condition, e.g. not being throttled for this selection process, while a boolean value of false or 0 can represent A digital component may indicate that the pacing condition is not met, eg, being throttled for this selection process.

To enforce resource depletion (e.g., budget) and pacing rules, computing systems MPC1 and MPC2 use probabilities determined using feedback controllers and resource depletion conditions to determine whether digital components are included in the digital component selection process. You can randomly block them from participating. The probability is set to 1 if the campaign containing the digital component does not have any additional resources. Otherwise, if the campaign is ahead of the delivery schedule, e.g., by calculating the secret shares [pacing_check _i,1 ] and [pacing_check _i,2 ] such that the pacing control check parameter pacing_check _i has a value of 0 , the probability is set high (eg, greater than 0 and closer to 1) so that computing systems MPC1 and MPC2 are more likely to block the digital component from the digital component selection process. The probability is lower if the campaign is after the delivery schedule.

Computing systems MPC1 and MPC2 may periodically compute the pacing selector parameter pacing_selector for each campaign in the additive secret share using a feedback controller. Conceptually, the pacing selector parameter is a throttling probability scaled up in multiples of the maximum range.

For each digital component request and each digital component, the computing systems MPC1 and MPC2 compute a secret number uniformly distributed within [0, maximum range]. If the random number is less than or equal to the pacing selector parameter pacing_selector, computing systems MPC1 and MPC2 may, for example, select secret shares [pacing_check _i,1 ] and [pacing_check _{i,2 ]} such that the pacing control check parameter pacing_check _i has a value of 0. ] to block digital components from participating in the digital component selection process.

Both the random number and the pacing selector parameters are within the additive secret share to protect the user privacy and confidential information of the participants in the digital component selection process. A comparison between two secret shares can be performed using the garbled circuit protocol. By limiting both secret shares to 6 or 7 bits, the comparison protocol may require one or two rounds of communication between computing systems MPC1 and MPC2.

To determine a campaign's pacing selector parameters, the computation system can compute the amount of resources used for each campaign as resources_used_campaign = Σ(clearing_value x is_dc_the_winner), and this sum is the digital component of the campaign. Throughout the digital component selection process including, the parameter clearing_value is the clearing value of the digital component selection process and is_dc_the_winner is the winner parameter of the digital component in the digital component selection process. This computation may be performed in secret shares such that each computing system MPC1 and MPC2 keeps a secret share of the amount of resources used. Computing systems MPC1 and MPC2 then calculate the resource exhaustion parameter resources_exhausted of the campaign by determining whether the amount of resources used, resources_used_campaign, is greater than the total amount of resources allocated to the campaign in the secret share. can do.

Computing systems MPC1 and MPC2 may compute the pacing selector parameter pacing_selector for each campaign as pacing_selector=resources_exhausted*maximum range+(1-resources_exhausted)*output, where parameter output is the output of the feedback controller. This computation can use a single RPC between computing systems MPC1 and MPC2 to compute the multiplication on the secret share. However, the computations may be performed offline periodically to prevent adding any latency.

Computing systems MPC1 and MPC2 jointly perform a k-anonymity check for each digital component i that must satisfy a k-anonymity condition, which in some embodiments can be applied to all digital components. It is also possible to compute the secret share of each of [kanonymity_check _i,1 ] and [kanonymity_check _i,2 ] of the parameter kanonymity_check _i . The combination of the two secret shares can be a Boolean value representing whether the digital component satisfies the k-anonymity condition. For example, a value of 1 can represent that the digital component satisfies k-anonymity, and a value of 0 indicates that the digital component does not satisfy k-anonymity and should be blocked from the digital component selection process. can represent

Computing systems MPC1 and MPC2 periodically process logs (as described with reference to FIG. 9) to determine which winning digital component is (or could be) indicated by application 112. ), for example, identifying a digital component selection process for which a corresponding selection process identifier has been received in the impression notification. During these selection processes, computing systems MPC1 and MPC2 count the number of impressions shown (or potentially shown) by the user's application 112 as impression_show _i =Σ(is_dc_the_winner_i). Here i can represent a digital component or a campaign. The computation is performed in secret shares such that each computation system MPC1 and MPC2 has a secret share of the number impression_show _i of impressions. Computing systems MPC1 and MPC2 can then determine whether the number of impressions exceeds the value k, for example by comparing the number of impressions to k over the secret share.

For each condition of each conditional digital component (eg, a digital component with at least one condition), each computing system MPC1 and MPC2 can store a corresponding secret share of each condition's parameters for the digital component. Thus, as long as at least one MPC computing system is fair, neither computing system MPC1 nor MPC2 knows the values of the parameters in plaintext. Each digital component can be conditioned on zero or more conditions. For a given digital component selection process, some digital components may have different conditions and/or different condition quantities than other digital components.

Although some exemplary conditions are provided above, other conditions may also be used. In general, computing systems MPC1 and MPC2 can compute a secret share of conditional parameters using a secure MPC process. Criteria and techniques for determining conditional parameters may vary. In some implementations, the secret share of conditional parameters may be received from another computing system, such that, for example, computing systems MPC1 and MPC2 do not calculate conditional parameters.

Computing systems MPC1 and MPC2 can use the secret share of conditional parameters to determine whether a conditional digital component is a candidate for the digital component selection process. Computing systems MPC1 and MPC2 can use the secret share of the conditional parameters of the conditional digital component to calculate the secret share of the candidate parameter is_dc_a_candidate _i for each conditional digital component i. In general, if the conditional digital component is conditioned on each of the above conditions, the candidate parameters for digital component i can be calculated using Relation 3 below.
is_dc_a_candidate _i = ug_check _i AND blocked_check _i AND pacing_check _i AND kanonymity_check _i

Since the value of each conditional parameter is in the secret share, computing systems MPC1 and MPC2 cooperate in a secure MPC process using round-trip remote procedure calls (RPCs) to use the secret share of the conditional parameter. The corresponding secret shares [is_dc_a_candidate _i,1 ] and [is_dc_a_candidate _i,2 ] of the candidate parameters of digital component i can be determined. Any suitable secret sharing algorithm for determining a logical AND operation can be used to determine the secret shares [is_dc_a_candidate _i,1 ] and [is_dc_a_candidate _i,2 ] of the candidate parameters of digital component i. Computing systems MPC1 and MPC2 can use only the secret shares of the condition parameters of their conditions to determine the secret shares of the candidate parameters. At the end of this secure MPC process, computing system MPC1 retains the first secret share [is_dc_a_candidate _i,1 ] of each conditional digital component's candidate parameter, and computing system MPC2 keeps each conditional digital component's candidate parameter hold a second secret share [is_dc_a_candidate _i,2 ] of

In some embodiments, computing systems MPC1 and MPC2 evaluate relation 3 for each digital component using a garbled circuit protocol. In this example, one of the computing systems MPC1 or MPC2 may build a garbled circuit. For this example, assume that computing system MPC1 constructs a garbled circuit. Computing system MPC1 knows its own secret share, and there is only one possible bit pattern that computing system MPC2's secret share must hold in order for the digital component's candidate parameter to be true or 1. I also know With such properties, the computing system MPC1, for example, requires only a maximum of 50 gates to construct the garbled circuit when there are about 50 Boolean parameters in relation 3 in total.

In relation 3, there is only one user group membership condition parameter _{ug_checki} . However, if Bloom filters are used to represent user group memberships of users, Relation 3 can include the respective user group membership condition parameter ug_check _i for each hash function of the Bloom filter. Similarly, if the blocked digital component is represented using a Bloom filter, relation 3 contains the respective blocked digital component parameter blocked_check _i for each hash function of this Bloom filter. In relationship 3, pacing_check _i is present only if the owner of the digital component enables pacing checks.

Computing system MPC1 determines (410) the order of the digital components based on the selection values. Similarly, computing system MPC2 determines the order of the digital components based on the selected value (412). These two orders should be exactly the same because the inputs to the ordering process are the same on the two computational systems MPC1 and MPC2. Each computing system MPC1 and MPC2 can determine the order of the digital components. Each order may include candidate digital components and other digital components evaluated for candidate eligibility in step 408 . For example, the order may be all available digital components available for the digital component selection process, all eligible digital components for the digital component selection process (e.g., eligible based on the context signal), or if used can contain all the digital components in the second stage LUT. The order may be from the digital component with the highest selected value to the digital component with the lowest selected value. In some implementations, the selection value used for the order is, for example, the number of resources with which the selected digital component will be displayed after any sharing with DSP 150 and/or SSP 170. It may be the value to be provided to the publisher 140 plus any applicable boost.

When the selection values are plaintext, the computation systems MPC1 and MPC2 need not perform any round-trip computations to determine the order of the digital components. Alternatively, each computing system MPC1 and MPC2 can independently order the selection values. If each computation system MPC1 and MPC2 has a respective secret share of each selection value, and the selection values are stored as secret shares in each computation system MPC1 and MPC2, then the computation systems MPC1 and MPC2 order the selection values. A secure MPC process can be performed using round-trip computation for If a concatenation exists between two or more selection values, the computing systems MPC1 and MPC2 may use other metadata of the digital components corresponding to these selection values to deterministically break the concatenation. can.

Computing systems MPC1 and MPC2 determine the secret share of the cumulative value of each candidate digital component (414). Conceptually, the cumulative value of a given digital component is from the beginning of the order to the selected value of the given digital component, excluding the given digital component even if the given digital component is a candidate. represents the total number of candidate digital components of . That is, the cumulative value represents the number of candidate digital components that are more eligible for selection than the given digital component. This concept is illustrated in Table 3 below.

In some implementations, the cumulative value of a given digital component is the candidate digital component from the beginning of the order to the given digital component, including the given digital component if the given digital component is a candidate. represents the total number of In this example, the fourth column represents whether the cumulative value is equal to 1 instead of 0. For the sake of brevity, the rest of the discussion assumes that the cumulative value of a given digital component is a given for the first example, representing the total number of candidate digital components up to the digital component of .

Conceptually, in Table 3, the cumulative value (acc) is incremented for each digital component that has a candidate parameter is_dc_a_candidate equal to 1 as it progresses from the beginning of the sequence to the end of the sequence. As will be described below, the calculation of the cumulative value acc is performed in secret shares. For example, the highest selected value candidate parameter is_dc_a_candidate is equal to zero, so the digital component with the highest selected value has a cumulative value acc of zero. The candidate parameter is_dc_a_candidate of the second highest digital component is equal to 1, but none of the selected values above the second highest digital component have the candidate parameter is_dc_a_candidate equal to 1, so the cumulative value of the second highest digital component acc is also 0. Down the order, the cumulative value acc of the candidate parameter is_dc_a_candidate of the third highest selected digital component is incremented to a value of one based on the candidate parameter is_dc_a_candidate of the second highest selected value having a value of one. Since the candidate parameter is_dc_a_candidate of the third highest digital component is 0, the cumulative value acc of the fourth digital component is not incremented and has a value of 0 like the third highest digital component.

Using Table 3, computing systems MPC1 and MPC2 specify the overall candidate parameter is_dc_a_candidate for delivery to client device 110, as shown in the fourth column of Table 3. has a value of 1 and the accumulation value acc has a value of 0. It represents the digital component corresponding to the highest ordered selection value whose candidate parameter is_dc_a_candidate has a value of one. In order to maintain user privacy and ensure that no user data is leaked, the candidate parameter is_dc_a_candidate is within the secret share of computational systems MPC1 and MPC2, so computational systems MPC1 and MPC2 have the cumulative value acc of each digital component. Determine the secret shares and use round-trip calculations to determine which digital components have an accumulated value acc equal to 0 and a candidate parameter is_dc_a_candidate equal to 1.

Computing systems MPC1 and MPC2 can independently determine their secret share of the cumulative value acc of each digital component without any round-trip calculations according to a secret share algorithm in some embodiments. For example, the computation system MPC1 may, for each digital component i, traverse all digital components in order from highest to lowest, as described above with reference to Table 3, and select candidate digital components on the fly. The first share [acc _i,1 ] of the cumulative value acc can be determined by summing the parameter is_dc_a_candidate. Similarly, the computation system MPC2, for each digital component i, traverses all the digital components in order from highest to lowest, summing the candidate parameters is_dc_a_candidate of the digital components on the fly, thereby obtaining the second can determine the share [acc _i,2 ] of .

Computing systems MPC1 and MPC2 determine, for each digital component, a secret share of results indicating whether the cumulative value has a specified value (416). The specified value can be a value of 0, as shown in columns 3 and 4 of Table 3. As mentioned above, the digital component whose cumulative value is equal to 0 and whose overall candidate parameter is_dc_a_candidate is 1 is the digital component with the highest selected value among the candidate digital components.

Computing systems MPC1 and MPC2 participate in multi-land computations, e.g., multiple RPCs, as part of the secure MPC process to compute the equivalent operation acc _i == 0 on the secret share of each digital component i. can do. The equality operation is used to determine whether the accumulated value acc _i of digital component i has a value of zero. At the end of this process, computing system MPC1 has, for each digital component i, one secret share of the result acc _i == 0, and computing system MPC2 has, for each digital component, the other secret share of the result acc _i == 0. has a secret share of

Computing systems MPC ₁ and MPC ₂ determine (418) the secret share of the winner parameter is_dc_the_winner _i for each digital component i. Computing systems MPC1 and MPC2 may determine, for each digital component i, the winner parameter is_dc_the_winner _i based on the secret share of the cumulative value acc _i == 0 and the secret share of the candidate parameter is_dc_a_candidate _i for each digital component i. . The winner parameter is_dc_the_winner _i for each digital component i indicates whether digital component i is the winner of the selection process, e.g., whether digital component i is selected for delivery to client device 110 in response to a digital component request. It can be a boolean value indicating whether or not there is.

In some embodiments, computing systems MPC1 and MPC2 execute a secret share multiplication protocol to determine, for each selected value, the winner parameter is_dc_the_winner _i ==(is_dc_a_candidate _i ×(acc _i ==0)) in terms of the secret share. can be calculated. This may involve one RPC between computing systems MPC1 and MPC2 to multiply the two secret shares. At the end of this MPC process, the computing system MPC1 has one secret share of the result is_dc_the_winner _i represented as [is_dc_the_winner _i,1 ] = [is_dc_a_candidate _i,1 ] x ([acc _i,1 ] == 1) have. Similarly, computing system MPC2 has another secret share of result is_dc_the_winner _i denoted as [is_dc_the_winner _i,2 ]=[is_dc_a_candidate _sv,2 ] x ([acc _i,2 ]==0). Note that for all digital components, at most one digital component has a winner parameter is_dc_the_winner _i equal to 1, and this digital component is the digital component selected for delivery to the client device 110. sea bream. All other parameters are equal to 0.

For the first value selection process, computing systems MPC1 and MPC2 may perform a similar process to determine the winner parameter is_dc_the_winner _i for each digital component i. For example, computing systems MPC1 and MPC2 may perform a secret share equivalence test to determine the secret share of the first selected value parameter maybe_first_sv _i = (acc _i == 0). The first selection value parameter maybe_first_sv _i for digital component i may be a Boolean value representing whether the selection value for the digital component may be the highest among the candidate digital components. A selection value is the highest selection value among candidate digital components only if the digital component corresponding to the selection value is actually a candidate digital component. Thus, the parameter maybe_first_sv _i for the first selection value of digital component i represents whether the digital component has the highest selection value, if the digital component is indeed a candidate digital component. At the end of this equivalence test, computing system MPC1 has the first secret share [maybe_first_sv i,1 ] of the parameter maybe_first_sv _i of the first selected value of digital component i, and computing system MPC2 has the first secret share [maybe_first_sv _i,1 ] of digital component i has a second secret share [maybe_first_sv _i,2 ] of the parameter maybe_first_sv _i of the first selected value of .

Computing systems MPC1 and MPC2 can then use Relation 4 below to compute the winner parameter is_dc_the_winner _i for each digital component i with respect to the secret share.
is_dc_the_winner _i ==((is_dc_a_candidate _i = TRUE) AND (maybe_first_sv _i =TRUE))

Computing systems MPC1 and MPC2 determine a selection result (420). In some implementations, the computing systems MPC1 and MPC2 may compute the selection result based on the digital component's winner parameter and the digital component's digital component information element dc_information_element. As mentioned above, the digital component information element dc_information_element of the digital component can contain the selection value of the digital component and other data of the digital component.

Conceptually, the computing systems MPC1 and MPC2 can compute the selection result parameter "result" using relation 5 below.
result=Σ _i is_dc_the_winner _i ×dc_information_element _i

That is, the computing systems MPC1 and MPC2 can determine the sum of the products of the winner parameter is_dc_the_winner _i and the digital component information element dc_information_element _i over all digital components. In this example, the selection result has a value of 0 if there are no candidate digital components, or a value equal to the digital component information element dc_information_element of the selected digital component with the winner parameter is_dc_the_winner _i equal to 1. be either. In another example, the digital component information element dc_information_element can be replaced in relation 5 with the selected value of the digital component. In this example, the selection result either has a value of 0 if there are no candidate digital components, or has a value equal to the selection value of the selected digital component with the winner parameter is_dc_the_winner _i equal to 1. Become.

To perform the computation in the secret share, the computation system MPC1 takes all the digital components and can make plaintext the digital component information element dc_information_element _i of the digital component and the first secret share of the winner parameter of the digital component. Multiply by [is_dc_the_winner _i,1 ]. Computing system MPC1 can then determine the sum of these products and return the sum to the client device 110 that submitted the digital component request. That is, the computing system MPC1 can determine the summation using relation 6 below as the first secret share of the result [result ₁ ].
[result ₁ ]=Σ _i ([is_dc_the_winner _i ]×dc_information_element _i )

Computing system MPC ₂ can perform a similar computation to determine a second share of results [result ₂ ] using relationship 7 below.
[result ₂ ]=Σ _i ([is_dc_the_winner _i ]×dc_information_element _i )

Computing system MPC1 sends 422 a first share of the selection result [result ₁ ] to client device 110 . Similarly, computing system MPC2 sends a second share of the selection result [result ₂ ] to client device 110 (424). Application 112 then uses the two secret shares [result ₁ ] and [result ₂ ] to determine the selection result result, e.g., by determining the sum of the secret shares if an additive secret share algorithm is employed. can be reconstructed in plaintext. If the selection result has a value of 0, MPC cluster 130 has not identified a digital component for delivery to client device 110 . Otherwise, the selection result has a value equal to the digital component information element dc_information_element. Application 112 can parse the digital component information element dc_information_element to obtain the digital component's selection values and metadata. Application 112 can then display the digital component or perform a selection process using that digital component and other digital components received from SSP 170, as described above.

In some implementations, the selected digital component prevents either computing system MPC1 or MPC2 from being able to access the selected digital component in plaintext, and the digital component's client device 110 is sent to client device 110 using a mask to reduce latency in transmission to. In this example, application 112 can select a nonce for each digital component request and send the nonce with the digital component request. Application 112 can send a nonce to one of computing systems MPC1 or MPC2. For purposes of illustration, assume that the nonce is sent to computing system MPC2.

Both the application 112 and the computing system MPC2 can independently compute a mask the same size as the largest digital component creation, using the same algorithms and the same inputs. For example, the i-th bit of the mask can be represented as PRF(nonce, i), where PRF represents a pseudo-random function. Both application 112 and computing system MPC2 can keep the nonce and mask strictly secret from computing system MPC1.

To send the selected digital component to application 112, computing system MPC2 may send the [result ₂ ] bitwise XOR mask to computing system MPC1. Computing system MPC1 then sends [result ₁ ] bitwise XOR ([result ₂ ] bitwise XOR mask) to application 112 as a selection result, eg, in response to the digital component request.

Application 112 computes the [result ₁ ] bitwise XOR ([result ₂ ] bitwise XOR mask) bitwise XOR mask as a creation of the digital component. This is equivalent to [result ₁ ] bitwise XOR [result ₂ ]. This reduces the bandwidth required for the largest creation sizes while maintaining private information extraction guarantees. This reduces the bandwidth of the response to the transmission of the two secret shares of the selection result, as described above. Thus, there is little or no additional latency or bandwidth consumption in this privacy-preserving technique relative to the transmission of digital component creations as in other processes.

For the second value selection process, the computing systems MPC1 and MPC2 may compute the secret share of the second selection value parameter maybe_second_sv _i for each digital component. The second selected value parameter for digital component i may be a Boolean value representing whether the selected value of the digital component may be the second highest selected value among the candidate digital components. A selection value is the second highest selection value among candidate digital components only if the digital component corresponding to the selection value is actually a candidate digital component. Thus, the parameter maybe_second_sv _i for the second selection value of digital component i represents whether the digital component has the second highest selection value, if the digital component is indeed a candidate digital component. Computing systems MPC1 and MPC2 may perform a secret share equivalence test to determine the secret share for the second selected value parameter maybe_second_sv _i = (acc _i == 1).

At the end of this equivalence test, computing system MPC1 has the first secret share [maybe_second_sv _i,1 ] of the parameter maybe_second_sv _i of the second selected value of digital component i, and computing system MPC2 has digital component i has a second secret share [maybe_second_sv _i,2 ] of parameter maybe_second_sv _i with a second selected value of .

Computing systems MPC1 and MPC2 then, for each digital component i, determine if the result of is_dc_a_candidate _i AND maybe_second_sv _i is a boolean value of true or 1, to determine the second highest selected value for the secret share. Candidate digital components to have can be determined. That is, the computing systems MPC1 and MPC2 can determine which digital component is a candidate digital component and has a second selected value parameter maybe_second_sv _i having a Boolean value of true or one.

Conceptually, computation systems MPC1 and MPC2 can compute the second highest selection value among the candidates using relationship 8 below.
second_selection_value=Σ _i (selectionvalue _i x (is_dc_a_candidate _i AND maybe_second_sv _i ))

In relation 8, parameter 'selectionvalue _i ' is the selection value of digital component i (with any boost) and parameter 'second_selection_value' is the value of the second highest selection value among the candidate digital components. Using the relation, the second selection value is the selection value of the digital component that is a candidate and has a second selection value parameter that has a true boolean value. Boolean values in this relationship can be treated as values of 1 (true) or 0 (false).

In the secret share, computation systems MPC1 and MPC2 use the secret share to calculate the result of is_dc_a_candidate _i AND maybe_second_sv _i , and the result to two additive secret shares in Z ₂ space (e.g., add, then mod 2 ). Additionally, the selection value is plaintext. Relation 8 reduces the multiplication to a bitwise logical AND operation between each bit in the selected value in the plaintext representation and the 1-bit secret share of the result of is_dc_a_candidate _i AND maybe_second_sv _i held by each computing system MPC1 and MPC2. It can be simplified by replacing Additionally, the summation can be replaced with a bitwise XOR operation.

FIG. 5 is a swimlane diagram of an exemplary process 500 for selecting digital components for delivery to client devices. The operations of process 500 may be performed by computing system MPC1 or computing system MPC2 of MPC cluster 130, for example. The operations of process 500 may be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, and execution of the instructions by one or more data processing devices may occur in one Or, multiple data processing devices may perform the operations of process 500 . As mentioned above, process 500 can be used for selection processes involving hierarchies.

Computing systems MPC1 and MPC2 determine (502) selected values for the digital components. Computing systems MPC1 and MPC2 may obtain or determine selection values in response to receiving digital component requests from client device 110 . Computing system MPC1 identifies eligible digital components that are eligible for the digital component selection process (504). Computing system MPC2 also identifies eligible digital components that are eligible for the digital component selection process (506). For each eligible digital component, computing systems MPC1 and MPC2 determine (508) whether the digital component is a candidate for the digital component selection process. Steps 502-508 may be the same as or similar to steps 402-408 of process 400 shown in FIG.

Computing system MPC1 groups (510) the digital components into a hierarchy. As noted above, publishers may establish hierarchies of DSPs 150 and/or digital component providers 160 . The hierarchy of publishers may include a highest priority tier, a lowest priority tier, and optionally one or more tiers between the highest and lowest priority.

Computing system MPC1 can determine the hierarchy of each digital component based on DSP 150 or digital component provider 160, which corresponds to the digital component and is provided, for example, with a selection value or vector of values for the digital component. Computing system MPC1 can then group the digital components into their respective hierarchies. Similarly, computing system MPC2 may group digital components into their respective hierarchies (512). The grouping of digital components in the hierarchy should be the same for both computing systems MPC1 and MPC2. In some implementations, SSP 170 explicitly determines the hierarchy and then encodes it into metadata for each selection value to be stored, eg, cached, in MPC cluster 130 .

Computing systems MPC1 and MPC2 may then perform individual selection processes for each of one or more of their hierarchies to select digital components to provide in response to digital component requests (513 ). In some embodiments, computing systems MPC1 and MPC2 perform the selection process on the hierarchy in parallel. In some embodiments, computing systems MPC1 and MPC2 perform the selection process sequentially, starting with the highest priority tier and descending tier by tier until the selection process has been performed for all tiers. To go. In some implementations, computing systems MPC1 and MPC2 may stop when a candidate is found in the hierarchy, but this may expose user sensitive information to exposure to computing systems MPC1 and MPC2. . The steps within the dashed box are performed for each hierarchy where the individual selection process is performed.

Computing system MPC1 orders (514) the digital components grouped into hierarchies by selection values. The selection values may be ordered first by hierarchy priority and then by selection value within the same hierarchy. Similarly, computing system MPC2 orders (516) the digital components grouped into hierarchies by selection values. For each hierarchy, these steps 514 and 516 are similar to steps 410 and 412 of process 400 shown in FIG. However, the sequence only includes digital components contained within the hierarchy.

Computing systems MPC1 and MPC2 cooperate to determine the secret share of the cumulative value acc _i of each digital component in the hierarchy (518). As noted above, the cumulative value of a given digital component is the selected value of the given digital component from the beginning of the order, excluding the given digital component even if the given digital component is a candidate. can represent the total number of candidate digital components up to . Computing systems MPC1 and MPC2 may determine the cumulative value of the digital components in the hierarchy in a manner similar to that described above with reference to step 414 of process 400 of FIG.

Computing systems MPC1 and MPC2 can independently determine their secret share of the cumulative value acc of each digital component without any round-trip calculations according to a secret share algorithm in some embodiments. For example, the computing system MPC1 may, for each digital component i, traverse all digital components in the hierarchy in order from highest to lowest, as described above with reference to Table 3, and digital A first share [acc _i,1 ] of the cumulative value acc can be determined by summing the component candidate parameters is_dc_a_candidate. Similarly, the computation system MPC2, for each digital component i, traverses all the digital components in the hierarchy in order from highest to lowest, summing the digital component's candidate parameter is_dc_a_candidate on the fly to obtain the cumulative value acc A second share of [acc _i,2 ] can be determined.

Computing systems MPC1 and MPC2 determine, for each candidate digital component in the hierarchy, a secret share of results indicating whether the cumulative value is equal to a specified value (520). The specified value can be a value of 0, as shown in columns 3 and 4 of Table 3. Within the hierarchy, a digital component with a cumulative value of 0 and an overall candidate parameter is_dc_a_candidate with a boolean value of true or 1 is the digital with the highest selection value among the candidate digital components in the hierarchy, if any. is a component.

Computational systems MPC1 and MPC2 participate in multiple rounds of computation, e.g., multiple RPCs, as part of the secure MPC process to compute the equivalent operation acc _i == 0 on the secret share of each digital component i. can do. The equality operation is used to determine whether the accumulated value acc _i of digital component i has a value of zero. At the end of this process, computing system MPC1 has, for each digital component i in the hierarchy, one secret share with the result acc _i == 0, and computing system MPC2 has, for each digital component in the hierarchy, the result acc It has the secret share of the other with _i == 0.

Computing systems MPC1 and MPC2 determine the secret share of the winning parameter for each digital component in the hierarchy (522). Computing systems MPC1 and MPC2 compute the _winner parameter _{is_dc_the_winner i} can be determined. The winner parameter is_dc_the_winner _i for each digital component i determines whether digital component i is a candidate digital component and whether digital component i has the highest selection value among candidate digital components in the hierarchy. It can be a boolean indicating whether the process is the winner. In some embodiments, computational systems MPC1 and MPC2 run a secret share multiplication protocol to compute, for each selected value, the winner parameter is_dc_the_winner _i =(is_dc_a_candidate _i ×(acc _i ==0)) in terms of secret shares. can do.

Computing systems MPC1 and MPC2 determine the selection result (524). Computing systems MPC1 and MPC2 select by determining the highest stratum containing a digital component with a winner parameter is_dc_the_winner _i with a value (e.g., boolean true or 1) indicating that the digital component is the winner of the stratum. result can be determined. This digital component is the winner of the entire digital component selection process. Calculation systems MPC1 and MPC2 can use the cumulative value to determine the highest tier with a winner parameter equal to true or one. For example, computing systems MPC1 and MPC2 can identify the highest hierarchy in which all digital components in the hierarchy have non-zero cumulative values.

Computing system MPC1 provides the first secret share of the selection result to the client device 110 from which the digital component request was received (526). Computing system MPC2 provides a second secret share of the selection result to the client device 110 from which the digital component request was received (528).

In a second value selection process that includes a hierarchy, the selected value of the digital component provides the second selected value of the selection process only if the digital component is within the same hierarchy as the digital component being selected. eligible for To determine the second selection value, computing systems MPC1 and MPC2 determine, for each tier t, a winning tier parameter representing whether tier t contains the digital component selected for delivery to client device 110. Maybe_winning_tier _t can be calculated. Conceptually, computation systems MPC1 and MPC2 can compute the winning tier parameter maybe_winning_tier _t for each tier t using relationship 9 below.

In relation 9, the parameter 'T' represents all tiers with a higher priority than tier t. Thus, the tier's winning tier parameter maybe_winning_tier _t represents whether any higher priority tier contains the candidate digital component. Otherwise, stratum t is a winning stratum if it contains at least one candidate digital component.

An equality test between the sum and the value 0 can also be computed using an RPC between computation systems MPC1 and MPC2. Multiple RPCs of various computations can be grouped together into fewer RPCs to reduce latency and network bandwidth consumption between computing systems MPC1 and MPC2.

Calculation systems MPC1 and MPC2 then determine that the second selection value is determined by the second selection value of the given digital component to the candidate parameter is_dc_a_candidate _i of the given digital component (as described above with reference to FIG. 4). determined based on the combination of the digital component's second choice value parameter maybe_second_sv _i , and the winning tier parameter maybe_winning_tier _t of the tier t containing the given digital component. be able to. For example, the second selection value is set by the selection value of a given digital component when is_dc_a_candidate _i AND maybe_second_sv _i AND maybe_winning_tier _t of the given digital component has a boolean value of true or one.

Computing systems MPC1 and MPC2 can then use the selected value of the given digital component to determine a second selected value. For example, the second selection value may equal the selection value of the given digital component or the selection value of the given digital component plus a specified amount.

DSP 150 and digital component provider 160 often know the best other selection values for digital component processes so that they can optimize or improve the selection values they provide for digital components in similar selection processes. can benefit from it. For example, the DSP 150 whose digital component was selected may benefit from knowing how much higher its selected value was than the next higher selected value. Similarly, a DSP 150 whose digital component was not selected may benefit from knowing how high the selection value must be for the digital component to be selected. If DSP 150 and/or digital component provider 160 provide selection values based on this information, DSP 150 can, for example, avoid waste due to excessively high selection values or digital It is more likely to achieve its objectives, such as avoiding loss of component presentation opportunities.

For the DSP 150 or digital component provider 160 whose digital component was selected, the highest other selection value is the second highest selection value. For all others, the highest other selected value is the highest selected value. This is the same for both the first value selection process and the second value selection process.

FIG. 6 is an illustration of an exemplary process 600 for determining best alternative selection values for digital components within a digital component selection process. The operations of process 600 may be performed by computing system MPC1 or computing system MPC2 of MPC cluster 130, for example. The operations of process 600 may be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, and execution of the instructions by one or more data processing devices may occur in one Or, multiple data processing devices may perform the operations of process 600 .

Computing systems MPC1 and MPC2 perform a digital component selection process to select digital components for delivery to client devices (602). Computing systems MPC1 and MPC2 may cooperate using a secure MPC process to select digital components as described above with reference to FIGS.

Computing systems MPC1 and MPC2 determine a first selection value for the digital component selection process (604). The first selection value may be the selection value of the digital component being selected for delivery to client device 110 . For example, the first selection value may be the highest selection value of the candidate digital components. If hierarchies are used, the first selection value may be the highest selection value of the candidate digital component in the highest priority hierarchy containing at least one candidate digital component.

Computing systems MPC1 and MPC2 may cooperate to determine the first selected value using a secure MPC process. Conceptually, computing systems MPC1 and MPC2 can use relationship 10 below to determine the first selection value.
first selection value= Σ(selection_value _i x (is_dc_a_candidate _i AND maybe_first_sv _i ))

This sum may be over all digital components involved in the digital component selection process. The selection value (selection_value _i ) for each digital component i can be plaintext. As described above, the computing systems MPC1 and MPC2 can compute the secret share of the candidate parameter is_dc_a_candidate _i and the first selection value parameter maybe_first_sv _i . The computing system MPC1 stores, for each digital component i, a first share [is_dc_a_candidate _{i ,1} ] of the candidate parameter is_dc_a_candidate i and a first share [maybe_first_sv _{i ,1} ] of the first selection value parameter maybe_first_sv i . be able to. Similarly, the computation system MPC2 computes, for each digital component i, the second share of the candidate parameter is_dc_a_candidate _{i ,2 ] and the second share of the first selection value parameter maybe_first_sv i,2 [} maybe_first_sv _i,2 ] can be stored.

Computing systems MPC1 and MPC2 determine a second selection value for the digital component selection process (606). The second selection value may be the next highest selection value after the selection value of the digital component being selected for delivery to client device 110 . For example, the second selected value may be the second highest selected value of the candidate digital component. If a hierarchy is used, the second selection value may be the second highest selection value of the candidate digital component within the highest priority hierarchy containing at least one candidate digital component.

Computing systems MPC1 and MPC2 may cooperate to determine the second selected value using a secure MPC process. Conceptually, computing systems MPC1 and MPC2 can use relationship 11 below to determine the second selection value.
second selection value= Σ(selection_value _i x (is_dc_a_candidate _i AND maybe_second_sv _i ))

This sum may be over all digital components involved in the digital component selection process. As described above, the computing systems MPC1 and MPC2 can compute the secret share of the candidate parameter is_dc_a_candidate _i and the second selected value parameter maybe_second_sv _i . The computing system MPC1 may store, for each digital component i, a first share [maybe_second_sv _{i ,1} ] of the second selection value parameter maybe_second_sv i . Similarly, the computing system MPC2 may store for each digital component i a second share [maybe_second_sv _{i ,2} ] of the second selection value parameter maybe_second_sv i .

In relations 10 and 11, true and false Boolean values can be treated as 1 and 0 respectively. In the secret share, computational systems MPC1 and MPC2 compute the result of the AND operation of both relations 10 and 11 using the secret share (e.g., using RPCs between computational systems), and store the result in the _Z2 space as the two additive secret shares in (eg, added and then mod 2). Each computing system can thus store a secret share of the first selection value and the second selection value. For example, computing system MPC1 may store a first share of a first selection value and a first share of a second selection value. Similarly, the computing system MPC2 can store a second share of the first selection value and a second share of the second selection value. The sum of the two shares of the first selection value (e.g. added and then mod 2) is equal to the first selection value, and the sum of the two shares of the second selection value (e.g. , then mod 2) is equal to the second selection value.

Relations 10 and 11 apply the multiplication of each selection value (selection_value _i ) of the above selection values to the candidate parameters and parameters of the first selection value held by each computational system MPC1 and MPC2 (or of the second selection value parameter) by replacing it with a bitwise AND operation with the 1-bit secret share of the result of the AND operation. Additionally, the summation of relations 10 and 11 can be replaced with a bitwise XOR operation.

For each digital component, computing systems MPC1 and MPC2 compute (608) the best other selection value. Calculation systems MPC1 and MPC2 can use a two-step process in secret shares to calculate the best alternative value of the digital component. Computing systems MPC1 and MPC2 can compute the winner parameter is_dc_the_winner _i for digital component i. Computing systems MPC1 and MPC2 may compute the winner parameter is_dc_the_winner _i using the secret share of the candidate parameter is_dc_a_candidate _i and the secret share of the first selection value parameter maybe_first_sv _i , for example is_dc_the_winner _i = is_dc_a_candidate _i AND maybe_first_sv _i .

Calculation systems MPC1 and MPC2 can then use relationship 12 to calculate the best other selected value (HOSV _i ) of digital component i.
HOSV _i =(is_dc_the_winner _i ×second selection value)+((1-is_dc_the_winner _i )×first selection value)

Since the winning parameter, the first selection value, and the second selection value are held in a secret share by computing systems MPC1 and MPC2, computing systems MPC1 and MPC2 cooperate to cooperate with the two computing systems MPC1. RPCs to and from MPC2 are used to determine the best other selection value.

At the end of this process, computing system MPC1 stores the first share [HOSV _i,1 ] of the best other selection value of digital component i, and computing system MPC2 stores the best other selection value of digital component i. Store the second share of values [HOSV _i,2 ].

Computing system MPC1 sends (610) a first share of the best other selected value for each digital component, eg, to DSP 150 or digital component 160 corresponding to the digital component. Similarly, computing system MPC2 sends a second share of the highest other selected value for each digital component (612), eg, to DSP 150 or digital component 160 corresponding to the digital component. In some embodiments, computing systems MPC1 and MPC2 provide shares to an aggregation service that aggregates each DSP's 150 and/or each digital component provider's 160 information.

The two secret share recipients can combine the shares to derive the best alternative selection value for the digital component in the digital component selection process. For example, if an additive secret sharing algorithm is used, the recipient can derive the best other choice value by adding the two shares.

Computing systems MPC1 and MPC2 can send additional data along with the best other selection values. For example, computing systems MPC1 and MPC2 may transmit contextual signals of the digital component selection process, eg search keys, along with their share of the highest other selection values. In this way, a landscape of selection values for digital component selection processes with the same or similar contexts can be computed using the best other selection values for digital component selection processes with the same or similar contexts.

In some embodiments, to increase performance, computing systems MPC1 and MPC2 compute the best other selection value asynchronously after the selection results of the digital component selection process are provided to client device 110. be able to. This reduces latency in the transmission and display of digital components. In some embodiments, computing systems MPC1 and MPC2 may calculate the best other selection value when the load on computing systems MPC1 and MPC2 is lower than the baseline load.

For the selection process involving the floor of selection values, additional steps can be taken to accurately calculate the best other selection value. Calculation systems MPC1 and MPC2 can calculate the best other selection value as described with reference to FIG. Computing systems MPC1 and MPC2 may then adjust the highest other selected value to take account of the floor, for example so that no selected value is less than the applicable floor.

Let H denote the highest alternative value being calculated and F denote the applicable floor. The final best alternative value will be (H>F)*H+(1-H>F, which is equivalent to F+(H>F)*(H-F).

To protect user privacy, H is a form of secret share. Each computing system MPC1 and MPC2 holds one of the secret shares [H ₁ ] and [H ₂ ] respectively. Computing system MPC1 can use relationship 13 to compute the first share of the final highest other selected value in the secret share.
[ _HOSV1 ]=F+([ _H1 ]>F)×([ _H1 ]-F)

Similarly, computing system MPC2 can use relationship 14 to compute the second share of the final highest other selected value in the secret share.
[ _HOSV2 ]=F+([ _H2 ]>F)×([ _H2 ]-F)

This process of calculating the best alternative value of the digital component process, including the floor, can utilize 3 or more rounds of RPCs for comparison testing and 1 round of RPCs for multiplication.

When hierarchy and/or boosting are used in the digital component selection process, the first selection value, e.g., the selection value of the digital component to be selected, may be lower than the highest selection value among the candidate digital components. . For example, if a candidate digital component in the highest priority tier has a lower selection value than a candidate digital component in a lower priority tier, then the candidate digital component in the higher priority tier has a lower selection value can be selected despite having Similarly, the digital component may select the non-boosted (or lower boosted) selection value used in the digital component selection value such that what the publisher receives is lower than if the non-boosted digital component had been selected. It can receive a boost that makes it higher than the digital component. The MPC cluster 130 can determine the difference between the two values so that the publisher can analyze the opportunity costs associated with tiers and/or boosts.

FIG. 7 is a flow diagram of an exemplary process 700 for determining the difference between first selection values of an actual digital component selection process and a counterfactual digital component selection process. The operations of process 700 may be performed by computing system MPC1 or computing system MPC2 of MPC cluster 130, for example. The operations of process 700 may be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, and execution of the instructions by one or more data processing devices may occur in one Or, multiple data processing devices may perform the operations of process 700 .

Computing systems MPC1 and MPC2 perform the actual digital component selection process (702). Computing systems MPC1 and MPC2 may perform the actual digital component selection process to select digital components to provide to client device 110 in response to digital component requests. The actual digital component selection process may include a hierarchy of digital components and/or boosts to one or more digital components included in the digital component selection process. For example, the actual digital component process should be the same or similar to the process of Figures 3-5.

Computing systems MPC1 and MPC2 perform a counterfactual digital component selection process (704). The steps of the counterfactual digital component process can be similar to the steps of the actual digital component selection process. However, in the counterfactual digital component selection process, the layers and/or boosts of the actual digital component selection process are removed. If the actual digital component selection process involves hierarchy (eg, as in process 400 of FIG. 4), the counterfactual digital component selection process has all digital components in one group (eg, the , as in process 500). If the actual digital component selection process involved boosting the selected value of one or more digital components, those boosts are removed in the counterfactual digital component selection process. That is, the selection value in the counterfactual digital component selection process may be the received selection value rather than the boost selection value.

Computing systems MPC1 and MPC2 determine clear values for the actual digital component selection process (706). This clear value can be based on the selected value of the selected digital component. For example, the clear value may be the amount of selection value actually provided to the publisher to display the selected digital component. If the selected values of the digital components are boosted, the amount of boost affects the order of the selected values only when the cumulative value of each candidate digital component is determined in operation 414 .

In the second value selection process, the clear value is based on the next higher selected value after the selected digital component's selected value. If a hierarchy is used with the second selection value process, the second highest value will be the second highest value within the same hierarchy as the selected digital component. If there are no such candidate digital components in the same hierarchy, the second highest value may be the minimum value of the digital component selection process.

Computing systems MPC1 and MPC2 determine clear values for the counterfactual digital component selection process (708). This clear value can be based on the digital component being selected in the counterfactual digital component selection process. In the second value selection process, the clear value is based on the next higher selection value after the selection value of the selected digital component, similar to the clear value in the actual digital component selection process.

Calculation systems MPC1 and MPC2 determine the difference between the two clear values (710). Computing systems MPC1 and MPC can determine the difference by subtracting the clear value of the counterfactual digital component selection process from the clear value of the actual digital component selection value.

Computing systems MPC1 and MPC2 provide the difference to the recipient (712). For example, one of the computing systems can provide a difference to the publisher of the resource or application content with which the digital component was displayed after selection. In another example, one of the computing systems can provide differences to an aggregation server that aggregates publisher differences. In both examples, the computing system provides the difference data as well as the contextual signals of the actual digital component selection process, e.g. search keys, and the data identifying the publisher (if sent to the aggregation server). can do.

An aggregation server can aggregate the differences reported for each publisher and provide data, eg, in the form of an interactive user interface, that indicates the opportunity cost of using tiers and/or boosts. In some embodiments, computing systems MPC1 and MPC2 may also provide selection results to an aggregation server for each actual digital component selection process. In this way, the aggregation server can aggregate the opportunity cost of each DSP 150 and/or digital component provider 160 .

To reduce the latency in providing the selected digital component to the client device 110 of the actual digital component selection process, some or all of steps 704-712 of process 700 may be performed asynchronously, e.g. is provided to the client device 110.

FIG. 8 is a flow diagram of an exemplary process 800 for determining whether a user is a member of a user group using bloom filters transmitted using secret shares. The operations of process 800 may be performed, for example, by application 112 executing on client device 110 and computing systems MPC1 and MPC2 of MPC cluster 130 of FIG. The operations of process 800 may be implemented as instructions stored on one or more computer-readable media, which may be non-transitory, and execution of the instructions by one or more data processing devices may occur in one Or, multiple data processing devices may perform the operations of process 800 .

By using bloom filters to transmit data representing a user's group membership, the data identifying the user's user groups is not being transmitted in plaintext, thus reducing the amount of data transmitted and improving user privacy. can hold. To prevent computing systems MPC1 and MPC2 from being able to access a user's group membership in plaintext, application 112 does not send the entire Bloom filter to each computing system MPC1 and MPC2. A respective share, eg, a bloom filter secret share, can be sent to each computing system 112 . However, this may require sending the equivalent of sending two Bloom filters, one to each computing system MPC1 and MPC2. To prevent this and further reduce the amount of data sent from client device 110 over network 105 to computing systems MPC1 and MPC2, application 112 uses a first array generated using a nonce and an application The original Bloom filter being created by 112 can be sent to one of the computing systems, eg, computing system MPC1, and only the nonce can be sent to the other computing system MPC2. Thus, only one array is sent from client device 110 . Since the nonce can be small, say 16 bytes, this greatly reduces the amount of data sent from the client device 110, thereby reducing the bandwidth consumption, latency, and battery consumption of the client device 110. Reduce.

Although the process 800 is described in terms of bloom filters representing user membership in user groups, a similar process can be used to generate bloom filters to represent blocked digital components and whether digital components are blocked or not. You can inquire whether or not In that example, the Bloom filters represent identifiers of block digital components rather than identifiers of user groups.

The configuration of Bloom filters can be adapted for transmission and/or processing by computing systems MPC1 and MPC2. Bloom filter parameters are the number of user groups that can be represented by the Bloom filter, the desired false positive rate of the Bloom filter, the number of hash functions used to generate the Bloom filter, and the number of elements included in the Bloom filter. It contains a test if it is possible, as well as the size of the bloom filter.

Reducing the number of hash functions reduces the computational burden on the computing systems MPC1 and MPC2 when querying whether a user is a member of a user group. However, this can increase the false positive rate if the Bloom filter size remains constant. Given a target false positive rate, reducing the hash function may result in an increase in Bloom filter size, which may increase the amount of bandwidth consumed. Bloom filter parameters may thus be selected using a trade-off between bandwidth/battery consumption and computational burden for computing systems MPC1 and MPC2.

Application 112 generates (802) a bloom filter. Application 112 may generate Bloom filters using user group identifiers of user groups that include the user of application 112 as a member. To do so, the application 112 maps the user group identifier to one of its locations within the Bloom filter using each hash function of the Bloom filter. Application 112 can perform this operation for each user group identifier of the user. When constructing the Bloom filter for the block digital component, the application 112 may apply each hash function of the Bloom filter for the block digital component to each block digital component's identifier. A Bloom filter is a bit array A of size N. Each bit of the Bloom filter is either 0 or 1, ie A[i]ε{0,1}.

Application 112 and computing systems MPC1 and MPC2 may pre-agree on a pseudo-random function (PRF). PRF takes two parameters and can be inclusive to generate PRF members in {0, 1}.

Application 112 selects a nonce (804). For each digital component request, application 112 may, for example, randomly or pseudo-randomly select a nonce to be shared with only one of computing systems MPC1 or MPC2. In this example, the nonce is shared with computing system MPC2.

Application 112 computes a first array _A1 using the Bloom filter and the nonce (806). Application 112 may compute the first array _A1 using the agreed PRF. For example, application 112 can use relationship 15 to compute first array A1.
_A1 [i]=A[i] XOR PRF(nonce,i)

In relation 15, the XOR operation is a bitwise XOR operation.

Application 112 sends (808) the first array to computing system MPC1. Application 112 also sends a nonce to computing system MPC2 (810).

Computing system MPC2 computes a second array _A2 using the nonce (812). The computing system MPC2 can compute the second array A2 using the nonce and the PRF. For example, computing system MPC2 can use relation 16 to compute the second array A2.
_A2 [i]=PRF(nonce,i)

Computing systems MPC1 and MPC2 use the first array _A1 and the second array _A2 to determine whether the user is a member of one or more user groups (814). In general, a Bloom filter can be queried by applying each hash function of the Bloom filter to a user group identifier to determine the element of the Bloom filter that corresponds to the hash function and the user group identifier. For a user identifier, if each hash function element has a value of 1, this indicates that the user is a member of the group. Of course, due to the nature of Bloom filters, there may be some false positives.

Since neither computing system MPC1 nor MPC2 has access to the entire Bloom filter (instead, each has only the Bloom filter's secret share), computing systems MPC1 and MPC2 can use a cryptographic protocol to identify, by user group identifier, It can be determined whether the user is a member of the user group identifier. Some exemplary cryptographic protocols that may be used include Garbage Circuit and the Goldreich-Micali-Wigderson (GMW) protocol.

In any algorithm, the inputs to the algorithm are (conceptually) the secret shares of the Bloom filter, ie the first array _A1 and the second array _A2 . The output is a secret share of a set of Boolean messages, one for each digital component, ie whether or not the user is a member of the user group associated with the corresponding digital component.

In the GMW protocol, one of the MPC computing systems, eg, computing system MPC1, creates a truth table in which one row per possible bit pattern of secret sharing is occupied by computing system MPC2. Computing system MPC1 selects its own secret share of the result, e.g. Calculate the secret share of the computing system MPC2. After the truth table is constructed, the computing system MPC2 uses the oblivious transfer protocol to fetch just one row from the table based on its own secret share. In this protocol, one computing system transfers one of multiple pieces of information to another computing system, but does not know which piece of information (if any) has been transferred. This oblivious transfer protocol ensures that processes do not leak any information to any party.

The result of querying the Bloom filter for a given user group identifier is the secret share of the user group membership condition parameters for each hash function. The secret share of user group membership condition parameter can be used in the digital component selection process to determine whether the digital component corresponding to the user group is a candidate for the digital component selection process. For example, if 10 hash functions are used, computing system MPC1 will have 10 first secret shares of user group membership condition parameters for each user group identifier. Similarly, computing system MPC2 will have ten second secret shares of user group membership condition parameters for each user group identifier.

Computing systems MPC1 and MPC2 can similarly reconstruct the second array and query the Bloom filters if the Bloom filters represent identifiers of block digital components. The result of querying this bloom filter for a given digital component is the block condition parameter of each hash function. The secret share of block condition parameters can be used in the digital component selection process to determine whether a digital component is a candidate for the digital component selection process.

FIG. 9 is a block diagram of an exemplary MPC computing system 900. As shown in FIG. Any of the MPC computing systems described herein can be implemented using MPC computing system 900 . Alternatively, the MPC computing system may be implemented as one or more servers. However, the architecture and configuration of MPC computing system 900 provides many performance improvements compared to using general-purpose server configurations.

MPC computing system 900 includes load balancer 910 , serving pool 920 and log processor pool 940 . Computing system 900 also generates, updates, and otherwise maintains logs 930 and snapshots 950 .

In some implementations, the MPC computing system 900 is deployed in various geographic regions to reduce latency in selecting digital components and providing digital components to client devices 110 . For example, an MPC cluster having two or more MPC computing systems 900 can be deployed within each region of the set of regions. If each MPC cluster contains two MPC computing systems, eg, MPC1 and MPC2, each domain may contain a pair of MPC computing systems 900 operated by different parties. Each instance of MPC1 across all domains may be operated by a first party and each instance of MPC2 across all domains may be operated by a second party that is different from the first party.

An MPC cluster within a region may perform a digital component selection process for digital component requests generated by client devices 110 within that region. For example, instructions regarding digital component slots, eg, tags, sent to client device 110 in a particular region may include references to the network location of MPC computing system 900 within that particular region. In this manner, application 112 sends digital component requests and notifications to MPC computing system 900 within the appropriate region. In another example, a domain name service (DNS) or load balancer 910 selects the MPC computing system 900 closest to the client device 110 in physical distance.

MPC1 in a domain can cooperate with MPC2 in the same domain to select digital components and update logs based on requests received. This reduces the distance between MPC computing systems 900, thereby reducing latency and bandwidth consumption in performing collaborative computing that requires round trips between MPC computing systems 900. FIG. This also reduces latency and bandwidth consumption in data transmissions between client device 110 and MPC computing system 900, such as digital component requests, digital component responses, and impression notifications.

In some embodiments, the log processor pool 940 is enabled only within the appropriate subset of regions for creating and issuing snapshots to the MPC computing system 900 in other regions. For example, there may be a first MPC computing system MPC1 in each region operated by a first party. A subset of these first MPC computing systems can create a snapshot of all first MPC computing systems and publish this snapshot to other first MPC computing systems. Similarly, there may be a second MPC computing system MPC2 in each domain operated by a second party. A subset of these second MPC computing systems can create a snapshot of all second MPC computing systems and publish this snapshot to other second MPC computing systems. Importantly, the first MPC computing system does not share logs or snapshots with the second MPC computing system, and vice versa, to preserve user privacy. However, the first computing system and the second computing system can be used in a secure MPC process when at least a portion of the data is sensitive and/or secret and should not be accessible in plaintext by either computing system. to process the data in the log. To do this efficiently and without increasing latency or bandwidth consumption, the first subset of MPC computing systems and the second subset of MPC computing systems may be within the same region.

A load balancer 910 receives requests from applications 112 running on client devices 110 . These requests, which can be in the form of HTTP requests in some examples, can include digital component requests and notifications. Notifications can include impression notifications that notify MPC computing system 900 that a digital component has been displayed at client device 110 and, optionally, whether a user has interacted with the digital component. The impression notification may also include additional information, such as a selection process identifier that identifies the digital component selection process through which the displayed digital component was displayed. For the k-anonymity condition, the impression notification may also include data identifying the winners of the actual digital component selection process and the winners of the counterfactual selection process, so that the MPC computational system 900 Impression notifications can be updated.

A load balancer 910 can assign requests to the processors of the serving pool 920 to balance the load among the processors in the serving pool 920 . For example, the load balancer 910 can alternate order among the processors or monitor the load of each processor and allocate requests based on the current load.

Serving pool 920 includes multiple processors, each of which may be, for example, one or more microprocessors, one or more server class computers, and/or one or more application specific integrated circuits (ASICs). ) can be implemented as The serving pool processors handle incoming requests, which are typically latency sensitive. For example, a processor of serving pool 920 may cooperate with a processor of another MPC computing system 900 to implement a digital component selection process. Serving pool 920 processors may also update log 930 based on completed digital component selection processes and/or notifications received.

Serving pool 920 processors can maintain a current database of stored digital components. This database may contain the current values of the parameters and/or conditions of the digital components. For example, the database stores, for each stored digital component, a selection value or vector, a secret share of at least some parameters of conditions, such as conditions that can be calculated offline, e.g., k-anonymity and pacing; Remaining budget, number of impressions (eg, for k-anonymity terms), and/or other data for digital components used in digital component selection processes described herein may be included.

In some embodiments, the serving pool database is a snapshot. For example, each snapshot can have a version identifier that identifies the version of the snapshot. Both MPC systems should be running using the same snapshot version.

Logs 930 can include multiple types of logs that store various information related to digital components stored by the MPC cluster. For example, log 930 stores digital components and corresponding data for the digital components, such as, for example, selection values, selection value vectors, search keys, corresponding user group identifiers, conditions, and/or other suitable information. can include logs for

Log 930 may include a log of information for completed digital component requests. Such a log may include a selection process identifier for each digital component selection process, a clear value for the digital component selection process, and parameters for each digital component that was included in the digital component selection process. These parameters may include, for example, a secret share of digital component candidate parameters, winning parameters, selected values, and/or accumulated values.

Logs 930 may include logs of parameters used to determine whether conditions for digital components are met. For example, such logs may include, for each digital component, the number of impressions, the number of selections, the number of conversions, the total budget, the remaining budget, and/or the number of times the digital component has been presented (e.g., k-anonymity selected in the counterfactual selection process). To protect user privacy and confidentiality of sensitive user data, in some implementations log 930 includes a secret share of the above information.

Log processor pool 940 may include processors (eg, microprocessors, servers, or ASICs) that process logs 930 and generate snapshots 950 based on the logs. Each snapshot contains updates to the database maintained by the processors of serving pool 920 . For example, if a digital component is selected and displayed at the client device 110, the snapshot can include the updated remaining budget for the digital component and the updated number of impressions for the digital component. Log processor pool 940 can generate snapshots based on updated data in log 930 and issue snapshots to processors of serving pool 920 . Processors in log processor pool 900 may also issue snapshots to other MPC computing systems operated by the same party, for example, if log processor pool 940 is enabled only in some MPC computing systems 900. can also

To reduce latency in responding to requests, the processors of serving pool 920 can process these requests immediately after receiving them. Processes that are not time sensitive can be processed by processors in log processor pool 940 . For example, serving pool 920 may implement any process on the critical path of digital component selection and provision to client device 110 . Log processor pool 940 can run any process that is not on the critical path. However, updates to the database should be made quickly to ensure that digital components are selected using up-to-date information. Thus, using a different set of processors as provided by the architecture shown in Figure 9 allows both the digital component selection process and updates to the database to be performed very quickly.

FIG. 10 is a block diagram of an exemplary computer system 1000 that can be used to perform the operations described above. System 1000 includes processor 1010 , memory 1020 , storage devices 1030 and input/output devices 1040 . Each of components 1010, 1020, 1030, and 1040 may be interconnected using system bus 1050, for example. Processor 1010 is capable of processing instructions for execution within system 1000 . In some implementations, processor 1010 is a single-threaded processor. In another embodiment, processor 1010 is a multithreaded processor. Processor 1010 can process instructions stored in memory 1020 or on storage device 1030 .

Memory 1020 stores information within system 1000 . In one implementation, memory 1020 is a computer-readable medium. In some implementations, memory 1020 is a volatile memory unit. In another embodiment, memory 1020 is a non-volatile memory unit.

Storage device 1030 may provide mass storage for system 1000 . In some implementations, storage device 1030 is a computer-readable medium. In various different implementations, the storage device 1030 is, for example, a hard disk device, an optical disk device, a storage device shared over a network by multiple computing devices (eg, a cloud storage device), or some other mass storage device. can include

Input/output device 1040 performs input/output operations for system 1000 . In some implementations, the input/output device 1040 is a network interface device such as an Ethernet card, a serial communication device such as an RS-232 port, and/or a wireless interface device such as an 802.11 card. It may contain one or more. In another embodiment, input/output devices may include driver devices configured to receive input data and send output data to external devices 1060, such as keyboards, printers, and display devices. However, other implementations may be used, such as mobile computing devices, mobile communications devices, set-top box television client devices, and the like.

Although an exemplary processing system is illustrated in FIG. 10, the subject matter and functional operational implementations described herein may be implemented in other types of digital electronic circuits or in the structures and structures disclosed herein. may be implemented in computer software, firmware, or hardware, including structural equivalents of, or in a combination of one or more thereof.

Embodiments of the subject matter and operations described herein may be implemented in, or in, digital electronic circuitry, or computer software, firmware, or hardware, including the structures disclosed herein and structural equivalents thereof. Can be implemented in one or more combinations. Embodiments of the subject matter described herein comprise one or more computer programs, i.e., (one or more), for execution by or for controlling the operation of a data processing apparatus. It may be implemented as one or more modules of computer program instructions encoded on a computer storage medium. Alternatively or additionally, the program instructions may be transmitted to an artificially generated propagated signal, e.g. , may be encoded on a machine-generated electrical, optical, or electromagnetic signal. A computer storage medium may be or be included in a computer readable storage device, a computer readable storage substrate, a random or serial access memory array or device, or a combination of one or more thereof. Moreover, although a computer storage medium is not a propagated signal, a computer storage medium can be a source or destination of computer program instructions encoded in an artificially generated propagated signal. A computer storage medium may also be or be contained within one or more separate physical components or media (eg, multiple CDs, discs, or other storage devices).

The operations described herein may be implemented as operations performed by a data processing apparatus on data stored on one or more computer-readable storage devices or received from other sources.

The term "data processor" means any kind of apparatus, device, and for processing data including, by way of example, programmable processors, computers, systems-on-chips, or any number or combination of the above. Including machinery. The device may include dedicated logic circuitry, such as FPGAs (Field Programmable Gate Arrays) or ASICs (Application Specific Integrated Circuits). The apparatus also includes, in addition to hardware, code that creates an execution environment for the computer program in question, such as processor firmware, protocol stacks, database management systems, operating systems, cross-platform runtime environments, virtual machines, or any of these. It may contain code that constitutes a combination of one or more of them. Devices and execution environments can implement a variety of different computing model infrastructures, such as web services, distributed computing infrastructures, and grid computing infrastructures.

Computer programs (also called programs, software, software applications, scripts, or code) can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and stand-alone It may be deployed in any form, including as a program, or as modules, components, subroutines, objects, or other units suitable for use in a computing environment. A computer program may, but need not, correspond to a file in a file system. A program can be either in a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to that program. or in multiple collaboration files (eg, files that store one or more modules, subprograms, or portions of code). A computer program can be deployed to be executed on one computer or on multiple computers located at one site or distributed across multiple sites and interconnected by a communication network.

The processes and logic flows described herein are implemented by one or more programmable processors executing one or more computer programs to perform actions by operating on input data and generating output. can be performed. The processes and logic flows may also be performed by dedicated logic circuitry, such as FPGAs (Field Programmable Gate Arrays) or ASICs (Application Specific Integrated Circuits), and devices may also be implemented as such.

Processors suitable for the execution of a computer program include, by way of example, both general and special purpose microprocessors. Generally, a processor will receive instructions and data from read-only memory, random-access memory, or both. The essential elements of a computer are a processor for performing actions according to instructions, and one or more memory devices for storing instructions and data. Generally, a computer also includes, receives data from, or sends data to, one or more mass storage devices, such as magnetic, magneto-optical, or optical disks, for storing data. operably coupled to transfer, or both. However, a computer is not required to have such a device. Moreover, the computer may be used by another device such as a mobile phone, personal digital assistant (PDA), mobile audio or video player, game console, global positioning system (GPS) receiver, or It may be incorporated into a portable storage device (eg, Universal Serial Bus (USB) flash drive). Devices suitable for storing computer program instructions and data include, by way of example, semiconductor memory devices such as EPROM, EEPROM and flash memory devices, magnetic disks such as internal or removable disks, magneto-optical disks and CDs. - includes all forms of non-volatile memory, non-volatile media, and non-volatile memory devices, including ROM discs and DVD-ROM discs. The processor and memory may be augmented by, or embedded within, dedicated logic circuitry.

To provide user interaction, embodiments of the subject matter described herein include a display device, such as a CRT (Cathode Ray Tube) or LCD (Liquid Crystal Display) monitor, for displaying information to a user, and It can be implemented on a computer having a keyboard and pointing device such as a mouse or trackball that allows a user to provide input to the computer. Other types of devices may also be used to provide user interaction. For example, the feedback provided to the user may be any form of sensory feedback, e.g., visual, auditory, or tactile feedback, and the input from the user may be acoustic, audio, or tactile. It may be received in any form, including In addition, the computer can send documents to and receive documents from a device used by a user to, for example, render web pages in response to requests received from a web browser on the user's client device. You can interact with the user by sending to their web browser.

Embodiments of the subject matter described herein may include back-end components, eg, as data servers, or may include middleware components, eg, application servers, or may include front-end components, eg, when users or one or more such back-end components, middleware components, or front-end It can be implemented in a computing system containing any combination of components. The components of the system can be interconnected by any form or medium of digital data communication, eg, a communication network. Examples of communication networks include local area networks (“LAN”) and wide area networks (“WAN”), internetworks (eg, the Internet), and peer-to-peer networks (eg, ad-hoc peer-to-peer networks).

The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. In some embodiments, the server sends data (eg, HTML pages) to the client device (eg, to display data to and receive user input from a user interacting with the client device). Data generated at the client device (eg, results of user interactions) may be received from the client device at the server.

While this specification contains many specific implementation details, these should not be construed as limitations on the scope of any invention or what may be claimed, but rather specific to particular embodiments of particular inventions. should be construed as a description of the features. Certain features that are described in this specification in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination. Moreover, although features may be described above as working in several combinations, and may even be originally claimed as such, one or more from the claimed combinations Features may optionally be omitted from the combination, and the claimed combination may be directed to sub-combinations or variations of sub-combinations.

Similarly, although operations are shown in the figures in a particular order, this implies that such operations are performed in the specific order shown or sequential order to achieve desirable results; It should not be understood as requiring that all illustrated acts be performed. Multitasking and parallel processing may be advantageous in some situations. Moreover, the separation of various system components in the embodiments described above should not be understood as requiring such separation in all embodiments, as the program components and systems described It should be appreciated that, in general, they may be incorporated together in a single software product or packaged in multiple software products.

Accordingly, specific embodiments of the present subject matter have been described. Other embodiments are within the scope of the following claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve desirable results. Additionally, the processes illustrated in the accompanying drawings do not necessarily require the particular order illustrated or sequential order to achieve desirable results. Multitasking and parallel processing may be advantageous in some implementations.

100 environment
105 network
110 client devices
112 applications
130 Secure MPC Cluster
140 Publisher
142 websites
145 Resources
150 DSPs
160 Digital Component Provider
170 SSP
900 MPC calculation system
910 load balancer
920 serving pool
930 logs
940 log processor pool
950 snapshots
1000 computer system
1010 processor
1020 memory
1030 storage device
1040 I/O device
1050 system bus
1060 external device

Claims (10)

A computer-implemented method comprising:
receiving a digital component request and nonce from a client device by a first computing system of a secure multi-party computing (MPC) system;
generating an array containing bloom filter shares representing user group identifiers of user groups that include the user of the client device as a member based on the nonce and the function;
collaborating with one or more second computing systems of the secure MPC system for each of a plurality of user group identifiers and using the array to identify the user of the client device by the user group identifier; computing a first secret share for each of one or more user group membership condition parameters representing membership of a user group that
For each digital component of the plurality of digital components,
identifying a given user group identifier corresponding to said digital component; and in cooperation with each of said one or more second computing systems identified at least by said given user group identifier. by said respective first secret share of each user group membership condition parameter corresponding to a given user group and said given user group identifier maintained by each of said one or more second computers; calculating a first secret share of a candidate parameter based on a second secret share of said user group membership condition parameter corresponding to a given user group identified, said candidate parameter being said performing a calculating step indicating whether a digital component is an eligible candidate for said digital component request;
generating a first secret share of selection results representing the selected digital component based on the first secret share of the candidate parameter for each digital component and the selected value for each digital component;
and sending the first secret share of the selection result to the client device. The step of calculating, in cooperation with the one or more second computers of the second MPC system, the first secret share of the user group membership condition parameters comprises a garbled circuit protocol or a Goldreich- 2. The computer-implemented method of claim 1, comprising computing the first secret share of the user group membership condition parameter using one of the Micali-Wigderson (GMW) protocols. The step of calculating, in cooperation with each of the one or more second computers, the first secret share of the candidate parameters is performed on each secret share of the parameters for one or more additional conditions. 3. The computer-implemented method of any one of claims 1-2, comprising calculating the first secret share of the candidate parameter based on. receiving additional nonces for additional bloom filters representing sets of block digital components;
generating additional arrays representing shares of the additional bloom filters;
for one or more digital components of said plurality of digital components, in cooperation with said one or more second computing systems, and using said additional array, said digital component at said client device; calculating a first secret share of a block condition parameter representing whether or not it is blocked, wherein said candidate parameter of said digital component is based on said block condition parameter. 4. The computer-implemented method of any one of claims 1-3. The claim wherein the first secret share of the selection result comprises a result calculated by performing a bitwise XOR operation between the secret share of the selection result and a second mask received from the client device. Clause 5. The computer-implemented method of any one of clauses 1-4. 6. The computer implementation of any one of claims 1-5, wherein the first computing system comprises a serving pool comprising a set of processors and a load balancer to balance computational load among the set of processors. Method. The first computing system includes an additional set of processors that generate snapshots based on updates to a log containing data related to a completed digital component selection process and provide the snapshots to the serving pool. 7. The computer-implemented method of Claim 6, comprising a log processor pool. a system,
one or more processors;
and one or more storage devices storing instructions, said instructions, when executed by said one or more processors, to said one or more processors of any of claims 1 to 7. A system for carrying out the method of claim 1. A computer readable storage medium carrying instructions which, when executed by one or more processors, cause said one or more processors to perform the method of any one of claims 1 to 8. A computer program product comprising instructions which, when executed by a computer, cause said computer to perform the steps of the method according to any one of claims 1 to 7.

Images